QA Report

[code423n4]

1. Multiple initialization of contract

Description

The attacker can initialize the contract, take malicious actions, and allow it to be re-initialized by the project without any error being noticed.

Instances

// Link to github
function initialize(Task storage _self, uint256 _cost) public {

//actual codes used in program 

    function initialize(Task storage _self, uint256 _cost) public {
        _self.cost = _cost;
        _self.state = TaskStatus.Inactive;
        _self.alerts[uint256(Lifecycle.None)] = true;
    }

2.USE A MORE RECENT VERSION OF SOLIDITY

Use a solidity version of at least 0.8.13 to get the ability to use using for with a list of free functions

Instances

// Link to github
using Tasks for Task;
https://github.com/code-423n4/2022-08-rigor/blob/5ab7ea84a1516cb726421ef690af5bc41029f88f/contracts/Community.sol#L28-L29

//actual codes used 
contracts/Project.sol:30:    using Tasks for Task;
contracts/Project.sol:33:    using SafeERC20Upgradeable for IDebtToken
contracts/Community.sol:28:    using SafeERC20Upgradeable for IDebtToken;