QA Report

[code423n4]

QA-1: NameWrapper.setChildFuses can be invoked upon an un-minted node, leaving an un-minted one but with non-zero fuses and expiry

link: https://github.com/code-423n4/2022-07-ens/blob/ff6e59b9415d0ead7daf31c2ed06e86d9061ae22/contracts/wrapper/NameWrapper.sol#L456

If node = _makeNode(parentNode, labelhash) has not been minted before, this function will result in an un-minted node with non-zero fuses and expiry.

QA-2: best practice

link: https://github.com/code-423n4/2022-07-ens/blob/ff6e59b9415d0ead7daf31c2ed06e86d9061ae22/contracts/wrapper/NameWrapper.sol#L555-L574

    if (ens.owner(node) != address(this)) {
        ens.setSubnodeRecord(
            parentNode,
            labelhash,
            address(this),
            resolver,
            ttl
        );
        _addLabelAndWrap(parentNode, node, label, newOwner, fuses, expiry);
    } else {
        ens.setSubnodeRecord(
            parentNode,
            labelhash,
            address(this),
            resolver,
            ttl
        );
        _transferAndBurnFuses(node, newOwner, fuses, expiry);
    }

The ens.setSubnodeRecord is duplicated in both true and false branches. Move it out of the conditional branches can help improve the code quality and reduce deployment gas.