diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/aderyn-report-5-9-2024-7:56pm.md b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/aderyn-report-5-9-2024-7:56pm.md new file mode 100644 index 0000000..c455e0f --- /dev/null +++ b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/aderyn-report-5-9-2024-7:56pm.md @@ -0,0 +1,79 @@ +# Aderyn Analysis Report + +This report was generated by [Aderyn](https://github.com/Cyfrin/aderyn), a static analysis tool built by [Cyfrin](https://cyfrin.io), a blockchain security company. This report is not a substitute for manual audit or security review. It should not be relied upon for any purpose other than to assist in the identification of potential security vulnerabilities. +# Table of Contents + +- [Summary](#summary) + - [Files Summary](#files-summary) + - [Files Details](#files-details) + - [Issue Summary](#issue-summary) +- [Low Issues](#low-issues) + - [L-1: Solidity pragma should be specific, not wide](#l-1-solidity-pragma-should-be-specific-not-wide) + - [L-2: `public` functions not used internally could be marked `external`](#l-2-public-functions-not-used-internally-could-be-marked-external) + - [L-3: PUSH0 is not supported by all chains](#l-3-push0-is-not-supported-by-all-chains) + + +# Summary + +## Files Summary + +| Key | Value | +| --- | --- | +| .sol Files | 1 | +| Total nSLOC | 37 | + + +## Files Details + +| Filepath | nSLOC | +| --- | --- | +| contracts/GitcoinPassportEligibility.sol | 37 | +| **Total** | **37** | + + +## Issue Summary + +| Category | No. of Issues | +| --- | --- | +| High | 0 | +| Low | 3 | + + +# Low Issues + +## L-1: Solidity pragma should be specific, not wide + +Consider using a specific version of Solidity in your contracts instead of a wide version. For example, instead of `pragma solidity ^0.8.0;`, use `pragma solidity 0.8.0;` + +- Found in contracts/GitcoinPassportEligibility.sol [Line: 2](contracts/GitcoinPassportEligibility.sol#L2) + + ```solidity + pragma solidity ^0.8.19; + ``` + + + +## L-2: `public` functions not used internally could be marked `external` + +Instead of marking a function as `public`, consider marking it as `external` if it is not used internally. + +- Found in contracts/GitcoinPassportEligibility.sol [Line: 63](contracts/GitcoinPassportEligibility.sol#L63) + + ```solidity + function getWearerStatus(address _wearer, uint256 /*_hatId*/ ) + ``` + + + +## L-3: PUSH0 is not supported by all chains + +Solc compiler version 0.8.20 switches the default target EVM version to Shanghai, which means that the generated bytecode will include PUSH0 opcodes. Be sure to select the appropriate EVM version in case you intend to deploy on a chain other than mainnet like L2 chains that may not support PUSH0, otherwise deployment of your contracts will fail. + +- Found in contracts/GitcoinPassportEligibility.sol [Line: 2](contracts/GitcoinPassportEligibility.sol#L2) + + ```solidity + pragma solidity ^0.8.19; + ``` + + + diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-1.md b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-1.md new file mode 100644 index 0000000..f153dae --- /dev/null +++ b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-1.md @@ -0,0 +1,9 @@ +### [I-1] GitcoinPassportEligibility::GITCOIN_PASSPORT_DECODER function does not follow the mixedCase naming convention, resulting in potential confusion from code reviewers + +**Description:** All caps naming convention is reserved for constant variables. Although `GitcoinPassportEligibility::GITCOIN_PASSPORT_DECODER` returns an immutable constant value, it is still a function. Thus it should follow the mixedCase naming convention. + +**Impact:** Reduces the understanding and potential interactibility of the protocol, and muddies up automated tool's results.. + +**Proof of Concept:** Patrick Collins, a leader security smart contract auditor and educator follows the mixedCase naming convention. Alongside automated tools like Slither and Aderyn to report instances of functions not being correctly in mixedCase. Newcomers and the majority of developers, auditors, and researchers will follow these conventions. Alongside muddying up the information that is returned from the automated tools. + +**Recommended Mitigation:** Rename `GitcoinPassportEligibility::GITCOIN_PASSPORT_DECODER` to `GitcoinPassportEligibility::gitcoinPassportDecoder` to satisfy the requirement of functions being in mixedCase. \ No newline at end of file diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-2.md b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-2.md new file mode 100644 index 0000000..549454e --- /dev/null +++ b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-2.md @@ -0,0 +1,9 @@ +### [I-2] GitcoinPassportEligibility::SCORE_CRITERION function does not follow the mixedCase naming convention, resulting in potential confusion from code reviewers + +**Description:** All caps naming convention is reserved for constant variables. Although `GitcoinPassportEligibility::SCORE_CRITERION` returns an immutable constant value, it is still a function. Thus it should follow the mixedCase naming convention. + +**Impact:** Reduces the understanding and potential interactibility of the protocol, and muddies up automated tool's results.. + +**Proof of Concept:** Patrick Collins, a leader security smart contract auditor and educator follows the mixedCase naming convention. Alongside automated tools like Slither and Aderyn to report instances of functions not being correctly in mixedCase. Newcomers and the majority of developers, auditors, and researchers will follow these conventions. Alongside muddying up the information that is returned from the automated tools. + +**Recommended Mitigation:** Rename `GitcoinPassportEligibility::SCORE_CRITERION` to `GitcoinPassportEligibility::scoreCriterion` to satisfy the requirement of functions being in mixedCase. \ No newline at end of file diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-3.md b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-3.md new file mode 100644 index 0000000..bb5f854 --- /dev/null +++ b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-3.md @@ -0,0 +1,9 @@ +### [I-3] GitcoinPassportEligibility::getWearerStatus' first parameter, _wearer, does not follow the mixedCase naming convention, resulting in potential confusion from code reviewers + +**Description:** The underscore naming convention is an outdated practice for function parameters. + +**Impact:** Reduces the understanding and potential interactibility of the protocol, and muddies up automated tool's results. + +**Proof of Concept:** Patrick Collins, a leader security smart contract auditor and educator follows the mixedCase naming convention. Alongside automated tools like Slither and Aderyn to report instances of functions not being correctly in mixedCase. Newcomers and the majority of developers, auditors, and researchers will follow these conventions. Alongside muddying up the information that is returned from the automated tools. + +**Recommended Mitigation:** Rename `GitcoinPassportEligibility::getWearerStatus`' first parameter, `_wearer`, to `wearer` to satisfy the requirement of functions being in mixedCase. \ No newline at end of file diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-4.md b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-4.md new file mode 100644 index 0000000..7463a51 --- /dev/null +++ b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/findings/finding-4.md @@ -0,0 +1,13 @@ +### [G-1] `GitcoinPassportEligibility::getWearerStatus` does not have the most efficient visibility type. + +**Description:** `GitcoinPassportEligibility::getWearerStatus` is not called within `GitcoinPassportEligibility`, however its visibility is `public`. + +**Impact:** Increases the gas cost of calling the function. + +**Proof of Concept:** We can see that through fuzz testing public and external functions with the same parameters and operations, the external function resulted in costing less gas to call. + +`test_externalFunction(uint256[20]) (runs: 257, μ: 255839, ~: 255839)` + +`test_publicFunction(uint256[20]) (runs: 257, μ: 257286, ~: 257286)` + +**Recommended Mitigation:** Change `GitcoinPassportEligibility::getWearerStatus`'s visibility from `public` to `external`. \ No newline at end of file diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/logo.pdf b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/logo.pdf new file mode 100644 index 0000000..212ad1a Binary files /dev/null and b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/logo.pdf differ diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/metrics.html b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/metrics.html new file mode 100644 index 0000000..e69e341 --- /dev/null +++ b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/metrics.html @@ -0,0 +1,668 @@ + + + + Solidity Metrics + + + + +
Rendering Report...

Note: This window will update automatically. In case it is not, close the window and try again (vscode bug) :/
+ + \ No newline at end of file diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/metrics.md b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/metrics.md new file mode 100644 index 0000000..1df854c --- /dev/null +++ b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/metrics.md @@ -0,0 +1,277 @@ + +[get in touch with Consensys Diligence](https://consensys.io/diligence)
+ +[[ 🌐 ](https://consensys.io/diligence) [ 📩 ](mailto:diligence@consensys.net) [ 🔥 ](https://consensys.io/diligence/tools/)] +

+ + + +# Solidity Metrics for 'CLI' + +## Table of contents + +- [Scope](#t-scope) + - [Source Units in Scope](#t-source-Units-in-Scope) + - [Deployable Logic Contracts](#t-deployable-contracts) + - [Out of Scope](#t-out-of-scope) + - [Excluded Source Units](#t-out-of-scope-excluded-source-units) + - [Duplicate Source Units](#t-out-of-scope-duplicate-source-units) + - [Doppelganger Contracts](#t-out-of-scope-doppelganger-contracts) +- [Report Overview](#t-report) + - [Risk Summary](#t-risk) + - [Source Lines](#t-source-lines) + - [Inline Documentation](#t-inline-documentation) + - [Components](#t-components) + - [Exposed Functions](#t-exposed-functions) + - [StateVariables](#t-statevariables) + - [Capabilities](#t-capabilities) + - [Dependencies](#t-package-imports) + - [Totals](#t-totals) + +## Scope + +This section lists files that are in scope for the metrics report. + +- **Project:** `'CLI'` +- **Included Files:** + - `` +- **Excluded Paths:** + - `` +- **File Limit:** `undefined` + - **Exclude File list Limit:** `undefined` + +- **Workspace Repository:** `unknown` (`undefined`@`undefined`) + +### Source Units in Scope + +Source Units Analyzed: **`1`**
+Source Units in Scope: **`1`** (**100%**) + +| Type | File | Logic Contracts | Interfaces | Lines | nLines | nSLOC | Comment Lines | Complex. Score | Capabilities | +| ---- | ------ | --------------- | ---------- | ----- | ------ | ----- | ------------- | -------------- | ------------ | +| 📝 | GitcoinPassportEligibility.sol | 1 | **** | 111 | 105 | 31 | 62 | 23 | **♻️** | +| 📝 | **Totals** | **1** | **** | **111** | **105** | **31** | **62** | **23** | **♻️** | + + +Legend: [➕] + + + + +##### Deployable Logic Contracts +Total: 1 +* 📝 `GitcoinPassportEligibility` + + + +#### Out of Scope + +##### Excluded Source Units + +Source Units Excluded: **`0`** + +[➕] + + + +##### Duplicate Source Units + +Duplicate Source Units Excluded: **`0`** + +[➕] + + +##### Doppelganger Contracts + +Doppelganger Contracts: **`0`** + +[➕] + + + +## Report + +### Overview + +The analysis finished with **`0`** errors and **`0`** duplicate files. + + + + + +#### Risk + +
+ +
+ +#### Source Lines (sloc vs. nsloc) + +
+ +
+ +#### Inline Documentation + +- **Comment-to-Source Ratio:** On average there are`0.6` code lines per comment (lower=better). +- **ToDo's:** `0` + +#### Components + +| 📝Contracts | 📚Libraries | 🔍Interfaces | 🎨Abstract | +| ------------- | ----------- | ------------ | ---------- | +| 1 | 0 | 0 | 0 | + +#### Exposed Functions + +This section lists functions that are explicitly declared public or payable. Please note that getter methods for public stateVars are not included. + +| 🌐Public | 💰Payable | +| ---------- | --------- | +| 4 | 0 | + +| External | Internal | Private | Pure | View | +| ---------- | -------- | ------- | ---- | ---- | +| 0 | 1 | 0 | 2 | 2 | + +#### StateVariables + +| Total | 🌐Public | +| ---------- | --------- | +| 0 | 0 | + +#### Capabilities + +| Solidity Versions observed | 🧪 Experimental Features | 💰 Can Receive Funds | 🖥 Uses Assembly | 💣 Has Destroyable Contracts | +| -------------------------- | ------------------------ | -------------------- | ---------------- | ---------------------------- | +| `^0.8.19` | | **** | **** | **** | + +| 📤 Transfers ETH | ⚡ Low-Level Calls | 👥 DelegateCall | 🧮 Uses Hash Functions | 🔖 ECRecover | 🌀 New/Create/Create2 | +| ---------------- | ----------------- | --------------- | ---------------------- | ------------ | --------------------- | +| **** | **** | **** | **** | **** | **** | + +| ♻️ TryCatch | Σ Unchecked | +| ---------- | ----------- | +| `yes` | **** | + +#### Dependencies / External Imports + +| Dependency / Import Path | Count | +| ------------------------ | ------ | + + +#### Totals + +##### Summary + +
+ +
+ +##### AST Node Statistics + +###### Function Calls + +
+ +
+ +###### Assembly Calls + +
+ +
+ +###### AST Total + +
+ +
+ +##### Inheritance Graph + +[➕] + + +##### CallGraph + +[➕] + + +###### Contract Summary + +[➕] + +____ + +Thinking about smart contract security? We can provide training, ongoing advice, and smart contract auditing. [Contact us](https://consensys.io/diligence/contact/). + + + diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/report.md b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/report.md new file mode 100644 index 0000000..977c81b --- /dev/null +++ b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/report.md @@ -0,0 +1,155 @@ +--- +title: Gitcoin Passport Eligibity Module Report +author: Jacob Homanics +date: May 10, 2024 +header-includes: + - \usepackage{titling} + - \usepackage{graphicx} +--- + +\begin{titlepage} +\centering +\begin{figure}[h] +\centering +\includegraphics[width=0.5\textwidth]{logo.pdf} +\end{figure} +\vspace{2cm} +{\Huge\bfseries Gitcoin Passport Eligibity Module Report\par} +\vspace{1cm} +{\Large Version 1.0\par} +\vspace{2cm} +{\Large\itshape Jacob Homanics\par} +\vfill +{\large \today\par} +\end{titlepage} + +\maketitle + + + +Prepared by: [Jacob Homanics](https://twitter.com/homanics) + +# Table of Contents + +- [Table of Contents](#table-of-contents) +- [Protocol Summary](#protocol-summary) +- [Disclaimer](#disclaimer) +- [Risk Classification](#risk-classification) +- [Audit Details](#audit-details) + - [Scope](#scope) + - [Roles](#roles) +- [Executive Summary](#executive-summary) + - [Issues found](#issues-found) +- [Findings](#findings) +- [High](#high) +- [Medium](#medium) +- [Low](#low) +- [Informational](#informational) +- [Gas](#gas) + +# Protocol Summary + +GitcoinPassportEligibility Module is a module used primarliy for the Hats ecosystem to be integrated as an eligiblity module for Hats. It utilizes gitcoin passport to determine eligiblity based on whether an addresses' score passes a certain threshold. + +# Disclaimer + +Jacob Homanics makes all efforts to find as many vulnerabilities in the code in the given time period, but holds no responsibilities for the findings provided in this document. A security audit by Jacob Homanics is not an endorsement of the underlying business or product. The audit was time-boxed and the review of the code was solely on the security aspects of the Solidity implementation of the contracts. + +# Risk Classification + +| | | Impact | | | +| ---------- | ------------- | ------ | ------ | ---- | +| | | High | Medium | Low | +| | High | H | H/M | M | +| Likelihood | Medium | H/M | M | M/L | +| | Low | M | M/L | L | +| | Informational | None | None | None | +| | Gas | None | None | None | + +We use the [CodeHawks](https://docs.codehawks.com/hawks-auditors/how-to-evaluate-a-finding-severity) severity matrix to determine severity. See the documentation for more details. + +# Audit Details + +**The findings in this document correspond with the following commit hash:** +Commit Hash: + +``` +ba4b2663761d1809a0e16b5b716ce376aabc531c +``` + +## Scope + +``` +GitcoinPassportEligibility.sol +``` + +## Roles + +N/A + +# Executive Summary + +The codebase is small and served a single purpose, resulting in no major or critical risks. However we found several Informational or Gas vulnerabilities. + +The tools used were VSCode, Slither, and Aderyn. + +## Issues found + +| Severity | Number of issues found | +| ------------- | ---------------------- | +| High | 0 | +| Medium | 0 | +| Low | 0 | +| Informational | 3 | +| Gas | 1 | +| Total | 4 | + +# Findings + +## Informational + +### [I-1] GitcoinPassportEligibility::GITCOIN_PASSPORT_DECODER function does not follow the mixedCase naming convention, resulting in potential confusion from code reviewers + +**Description:** All caps naming convention is reserved for constant variables. Although `GitcoinPassportEligibility::GITCOIN_PASSPORT_DECODER` returns an immutable constant value, it is still a function. Thus it should follow the mixedCase naming convention. + +**Impact:** Reduces the understanding and potential interactibility of the protocol, and muddies up automated tool's results.. + +**Proof of Concept:** Patrick Collins, a leader security smart contract auditor and educator follows the mixedCase naming convention. Alongside automated tools like Slither and Aderyn to report instances of functions not being correctly in mixedCase. Newcomers and the majority of developers, auditors, and researchers will follow these conventions. Alongside muddying up the information that is returned from the automated tools. + +**Recommended Mitigation:** Rename `GitcoinPassportEligibility::GITCOIN_PASSPORT_DECODER` to `GitcoinPassportEligibility::gitcoinPassportDecoder` to satisfy the requirement of functions being in mixedCase. + +### [I-2] GitcoinPassportEligibility::SCORE_CRITERION function does not follow the mixedCase naming convention, resulting in potential confusion from code reviewers + +**Description:** All caps naming convention is reserved for constant variables. Although `GitcoinPassportEligibility::SCORE_CRITERION` returns an immutable constant value, it is still a function. Thus it should follow the mixedCase naming convention. + +**Impact:** Reduces the understanding and potential interactibility of the protocol, and muddies up automated tool's results.. + +**Proof of Concept:** Patrick Collins, a leader security smart contract auditor and educator follows the mixedCase naming convention. Alongside automated tools like Slither and Aderyn to report instances of functions not being correctly in mixedCase. Newcomers and the majority of developers, auditors, and researchers will follow these conventions. Alongside muddying up the information that is returned from the automated tools. + +**Recommended Mitigation:** Rename `GitcoinPassportEligibility::SCORE_CRITERION` to `GitcoinPassportEligibility::scoreCriterion` to satisfy the requirement of functions being in mixedCase. + +### [I-3] GitcoinPassportEligibility::getWearerStatus' first parameter, \_wearer, does not follow the mixedCase naming convention, resulting in potential confusion from code reviewers + +**Description:** The underscore naming convention is an outdated practice for function parameters. + +**Impact:** Reduces the understanding and potential interactibility of the protocol, and muddies up automated tool's results. + +**Proof of Concept:** Patrick Collins, a leader security smart contract auditor and educator follows the mixedCase naming convention. Alongside automated tools like Slither and Aderyn to report instances of functions not being correctly in mixedCase. Newcomers and the majority of developers, auditors, and researchers will follow these conventions. Alongside muddying up the information that is returned from the automated tools. + +**Recommended Mitigation:** Rename `GitcoinPassportEligibility::getWearerStatus`' first parameter, `_wearer`, to `wearer` to satisfy the requirement of functions being in mixedCase. + +## Gas + +### [G-1] `GitcoinPassportEligibility::getWearerStatus` does not have the most efficient visibility type. + +**Description:** `GitcoinPassportEligibility::getWearerStatus` is not called within `GitcoinPassportEligibility`, however its visibility is `public`. + +**Impact:** Increases the gas cost of calling the function. + +**Proof of Concept:** We can see that through fuzz testing public and external functions with the same parameters and operations, the external function resulted in costing less gas to call. + +`test_externalFunction(uint256[20]) (runs: 257, delta: 255839, ~: 255839)` + +`test_publicFunction(uint256[20]) (runs: 257, delta: 257286, ~: 257286)` + +**Recommended Mitigation:** Change `GitcoinPassportEligibility::getWearerStatus`'s visibility from `public` to `external`. diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/report.pdf b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/report.pdf new file mode 100644 index 0000000..f6fc035 Binary files /dev/null and b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/report.pdf differ diff --git a/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/slither-report-5-9-2024-7:56pm.md b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/slither-report-5-9-2024-7:56pm.md new file mode 100644 index 0000000..ad48716 --- /dev/null +++ b/audit-files/commit-ba4b2663761d1809a0e16b5b716ce376aabc531c/slither-report-5-9-2024-7:56pm.md @@ -0,0 +1,482 @@ +Summary + - [assembly](#assembly) (40 results) (Informational) + - [pragma](#pragma) (1 results) (Informational) + - [solc-version](#solc-version) (14 results) (Informational) + - [low-level-calls](#low-level-calls) (4 results) (Informational) + - [naming-convention](#naming-convention) (9 results) (Informational) +## assembly +Impact: Informational +Confidence: High + - [ ] ID-0 +[Clone._getArgUint248(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L102-L108) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L105-L107) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L102-L108 + + + - [ ] ID-1 +[Clone._getArgUint176(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L183-L189) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L186-L188) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L183-L189 + + + - [ ] ID-2 +[Clone._getArgUint216(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L138-L144) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L141-L143) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L138-L144 + + + - [ ] ID-3 +[Clone._getArgUint8(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L372-L378) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L375-L377) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L372-L378 + + + - [ ] ID-4 +[Clone._getArgUint112(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L255-L261) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L258-L260) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L255-L261 + + + - [ ] ID-5 +[Clone._getArgUint32(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L345-L351) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L348-L350) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L345-L351 + + + - [ ] ID-6 +[Clone._getArgBytes(uint256,uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L25-L40) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L32-L39) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L25-L40 + + + - [ ] ID-7 +[Clone._getArgBytes32(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L84-L90) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L87-L89) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L84-L90 + + + - [ ] ID-8 +[Clone._getArgUint160(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L201-L207) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L204-L206) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L201-L207 + + + - [ ] ID-9 +[Address._revert(bytes,string)](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L231-L243) uses assembly + - [INLINE ASM](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L236-L239) + +lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L231-L243 + + + - [ ] ID-10 +[Clone._getArgBytes32Array(uint256,uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L68-L81) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L75-L80) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L68-L81 + + + - [ ] ID-11 +[Clone._getArgUint168(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L192-L198) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L195-L197) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L192-L198 + + + - [ ] ID-12 +[Clone._getArgUint144(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L219-L225) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L222-L224) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L219-L225 + + + - [ ] ID-13 +[Clone._getArgUint88(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L282-L288) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L285-L287) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L282-L288 + + + - [ ] ID-14 +[Clone._getArgUint192(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L165-L171) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L168-L170) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L165-L171 + + + - [ ] ID-15 +[Clone._getArgAddress(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L43-L49) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L46-L48) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L43-L49 + + + - [ ] ID-16 +[Clone._getArgUint64(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L309-L315) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L312-L314) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L309-L315 + + + - [ ] ID-17 +[Clone._getArgUint200(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L156-L162) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L159-L161) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L156-L162 + + + - [ ] ID-18 +[Clone._getArgUint96(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L273-L279) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L276-L278) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L273-L279 + + + - [ ] ID-19 +[Clone._getArgUint128(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L237-L243) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L240-L242) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L237-L243 + + + - [ ] ID-20 +[Clone._getArgUint232(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L120-L126) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L123-L125) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L120-L126 + + + - [ ] ID-21 +[Clone._getArgUint56(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L318-L324) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L321-L323) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L318-L324 + + + - [ ] ID-22 +[Clone._getArgUint184(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L174-L180) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L177-L179) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L174-L180 + + + - [ ] ID-23 +[Clone._getArgUint40(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L336-L342) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L339-L341) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L336-L342 + + + - [ ] ID-24 +[Clone._getArgUint208(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L147-L153) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L150-L152) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L147-L153 + + + - [ ] ID-25 +[Clone._getArgUint48(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L327-L333) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L330-L332) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L327-L333 + + + - [ ] ID-26 +[Clone._getArgUint256Array(uint256,uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L52-L65) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L59-L64) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L52-L65 + + + - [ ] ID-27 +[Clone._getArgUint72(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L300-L306) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L303-L305) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L300-L306 + + + - [ ] ID-28 +[Clone._getArgUint16(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L363-L369) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L366-L368) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L363-L369 + + + - [ ] ID-29 +[Clone._getArgUint152(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L210-L216) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L213-L215) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L210-L216 + + + - [ ] ID-30 +[Clone._getArgBytes()](lib/hats-module/lib/solady/src/utils/Clone.sol#L10-L22) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L13-L21) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L10-L22 + + + - [ ] ID-31 +[Clone._getArgUint80(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L291-L297) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L294-L296) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L291-L297 + + + - [ ] ID-32 +[Clone._getArgUint256(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L93-L99) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L96-L98) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L93-L99 + + + - [ ] ID-33 +[Clone._getImmutableArgsOffset()](lib/hats-module/lib/solady/src/utils/Clone.sol#L381-L386) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L383-L385) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L381-L386 + + + - [ ] ID-34 +[Clone._getArgUint136(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L228-L234) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L231-L233) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L228-L234 + + + - [ ] ID-35 +[Clone._getArgUint224(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L129-L135) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L132-L134) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L129-L135 + + + - [ ] ID-36 +[Clone._getArgUint24(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L354-L360) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L357-L359) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L354-L360 + + + - [ ] ID-37 +[Clone._getArgUint240(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L111-L117) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L114-L116) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L111-L117 + + + - [ ] ID-38 +[Clone._getArgUint120(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L246-L252) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L249-L251) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L246-L252 + + + - [ ] ID-39 +[Clone._getArgUint104(uint256)](lib/hats-module/lib/solady/src/utils/Clone.sol#L264-L270) uses assembly + - [INLINE ASM](lib/hats-module/lib/solady/src/utils/Clone.sol#L267-L269) + +lib/hats-module/lib/solady/src/utils/Clone.sol#L264-L270 + + +## pragma +Impact: Informational +Confidence: High + - [ ] ID-40 +Different versions of Solidity are used: + - Version used: ['>=0.8.13', '^0.8.1', '^0.8.19', '^0.8.2', '^0.8.4', '^0.8.9'] + - [>=0.8.13](lib/hats-module/lib/hats-protocol/src/Interfaces/HatsErrors.sol#L17) + - [>=0.8.13](lib/hats-module/lib/hats-protocol/src/Interfaces/HatsEvents.sol#L17) + - [>=0.8.13](lib/hats-module/lib/hats-protocol/src/Interfaces/IHats.sol#L17) + - [>=0.8.13](lib/hats-module/lib/hats-protocol/src/Interfaces/IHatsEligibility.sol#L17) + - [>=0.8.13](lib/hats-module/lib/hats-protocol/src/Interfaces/IHatsIdUtilities.sol#L17) + - [^0.8.1](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L4) + - [^0.8.19](contracts/GitcoinPassportEligibility.sol#L2) + - [^0.8.19](lib/hats-module/src/HatsEligibilityModule.sol#L2) + - [^0.8.19](lib/hats-module/src/HatsModule.sol#L2) + - [^0.8.19](lib/hats-module/src/interfaces/IHatsModule.sol#L2) + - [^0.8.2](lib/hats-module/lib/openzeppelin-contracts/contracts/proxy/utils/Initializable.sol#L4) + - [^0.8.4](lib/hats-module/lib/solady/src/utils/Clone.sol#L2) + - [^0.8.9](lib/eas-proxy/contracts/IGitcoinPassportDecoder.sol#L2) + +lib/hats-module/lib/hats-protocol/src/Interfaces/HatsErrors.sol#L17 + + +## solc-version +Impact: Informational +Confidence: High + - [ ] ID-41 +Pragma version[^0.8.2](lib/hats-module/lib/openzeppelin-contracts/contracts/proxy/utils/Initializable.sol#L4) allows old versions + +lib/hats-module/lib/openzeppelin-contracts/contracts/proxy/utils/Initializable.sol#L4 + + + - [ ] ID-42 +Pragma version[>=0.8.13](lib/hats-module/lib/hats-protocol/src/Interfaces/HatsErrors.sol#L17) allows old versions + +lib/hats-module/lib/hats-protocol/src/Interfaces/HatsErrors.sol#L17 + + + - [ ] ID-43 +solc-0.8.22 is not recommended for deployment + + - [ ] ID-44 +Pragma version[^0.8.19](lib/hats-module/src/interfaces/IHatsModule.sol#L2) necessitates a version too recent to be trusted. Consider deploying with 0.8.18. + +lib/hats-module/src/interfaces/IHatsModule.sol#L2 + + + - [ ] ID-45 +Pragma version[>=0.8.13](lib/hats-module/lib/hats-protocol/src/Interfaces/HatsEvents.sol#L17) allows old versions + +lib/hats-module/lib/hats-protocol/src/Interfaces/HatsEvents.sol#L17 + + + - [ ] ID-46 +Pragma version[>=0.8.13](lib/hats-module/lib/hats-protocol/src/Interfaces/IHatsEligibility.sol#L17) allows old versions + +lib/hats-module/lib/hats-protocol/src/Interfaces/IHatsEligibility.sol#L17 + + + - [ ] ID-47 +Pragma version[>=0.8.13](lib/hats-module/lib/hats-protocol/src/Interfaces/IHatsIdUtilities.sol#L17) allows old versions + +lib/hats-module/lib/hats-protocol/src/Interfaces/IHatsIdUtilities.sol#L17 + + + - [ ] ID-48 +Pragma version[^0.8.9](lib/eas-proxy/contracts/IGitcoinPassportDecoder.sol#L2) allows old versions + +lib/eas-proxy/contracts/IGitcoinPassportDecoder.sol#L2 + + + - [ ] ID-49 +Pragma version[^0.8.1](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L4) allows old versions + +lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L4 + + + - [ ] ID-50 +Pragma version[^0.8.19](contracts/GitcoinPassportEligibility.sol#L2) necessitates a version too recent to be trusted. Consider deploying with 0.8.18. + +contracts/GitcoinPassportEligibility.sol#L2 + + + - [ ] ID-51 +Pragma version[^0.8.19](lib/hats-module/src/HatsEligibilityModule.sol#L2) necessitates a version too recent to be trusted. Consider deploying with 0.8.18. + +lib/hats-module/src/HatsEligibilityModule.sol#L2 + + + - [ ] ID-52 +Pragma version[^0.8.19](lib/hats-module/src/HatsModule.sol#L2) necessitates a version too recent to be trusted. Consider deploying with 0.8.18. + +lib/hats-module/src/HatsModule.sol#L2 + + + - [ ] ID-53 +Pragma version[^0.8.4](lib/hats-module/lib/solady/src/utils/Clone.sol#L2) allows old versions + +lib/hats-module/lib/solady/src/utils/Clone.sol#L2 + + + - [ ] ID-54 +Pragma version[>=0.8.13](lib/hats-module/lib/hats-protocol/src/Interfaces/IHats.sol#L17) allows old versions + +lib/hats-module/lib/hats-protocol/src/Interfaces/IHats.sol#L17 + + +## low-level-calls +Impact: Informational +Confidence: High + - [ ] ID-55 +Low level call in [Address.functionStaticCall(address,bytes,string)](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L155-L162): + - [(success,returndata) = target.staticcall(data)](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L160) + +lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L155-L162 + + + - [ ] ID-56 +Low level call in [Address.functionDelegateCall(address,bytes,string)](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L180-L187): + - [(success,returndata) = target.delegatecall(data)](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L185) + +lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L180-L187 + + + - [ ] ID-57 +Low level call in [Address.functionCallWithValue(address,bytes,uint256,string)](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L128-L137): + - [(success,returndata) = target.call{value: value}(data)](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L135) + +lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L128-L137 + + + - [ ] ID-58 +Low level call in [Address.sendValue(address,uint256)](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L64-L69): + - [(success) = recipient.call{value: amount}()](lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L67) + +lib/hats-module/lib/openzeppelin-contracts/contracts/utils/Address.sol#L64-L69 + + +## naming-convention +Impact: Informational +Confidence: High + - [ ] ID-59 +Function [HatsModule.HATS()](lib/hats-module/src/HatsModule.sol#L43-L45) is not in mixedCase + +lib/hats-module/src/HatsModule.sol#L43-L45 + + + - [ ] ID-60 +Function [GitcoinPassportEligibility.SCORE_CRITERION()](contracts/GitcoinPassportEligibility.sol#L42-L44) is not in mixedCase + +contracts/GitcoinPassportEligibility.sol#L42-L44 + + + - [ ] ID-61 +Function [IHatsModule.HATS()](lib/hats-module/src/interfaces/IHatsModule.sol#L8) is not in mixedCase + +lib/hats-module/src/interfaces/IHatsModule.sol#L8 + + + - [ ] ID-62 +Parameter [GitcoinPassportEligibility.getWearerStatus(address,uint256)._wearer](contracts/GitcoinPassportEligibility.sol#L63) is not in mixedCase + +contracts/GitcoinPassportEligibility.sol#L63 + + + - [ ] ID-63 +Function [HatsModule.IMPLEMENTATION()](lib/hats-module/src/HatsModule.sol#L38-L40) is not in mixedCase + +lib/hats-module/src/HatsModule.sol#L38-L40 + + + - [ ] ID-64 +Function [GitcoinPassportEligibility.GITCOIN_PASSPORT_DECODER()](contracts/GitcoinPassportEligibility.sol#L37-L39) is not in mixedCase + +contracts/GitcoinPassportEligibility.sol#L37-L39 + + + - [ ] ID-65 +Parameter [HatsModule.setUp(bytes)._initData](lib/hats-module/src/HatsModule.sol#L65) is not in mixedCase + +lib/hats-module/src/HatsModule.sol#L65 + + + - [ ] ID-66 +Function [IHatsModule.IMPLEMENTATION()](lib/hats-module/src/interfaces/IHatsModule.sol#L11) is not in mixedCase + +lib/hats-module/src/interfaces/IHatsModule.sol#L11 + + + - [ ] ID-67 +Parameter [GitcoinPassportEligibility.isHuman(address)._wearer](contracts/GitcoinPassportEligibility.sol#L90) is not in mixedCase + +contracts/GitcoinPassportEligibility.sol#L90 \ No newline at end of file diff --git a/packages/foundry/contracts/GitcoinPassportEligibility.sol b/packages/foundry/contracts/GitcoinPassportEligibility.sol index defe7db..9b8fec3 100644 --- a/packages/foundry/contracts/GitcoinPassportEligibility.sol +++ b/packages/foundry/contracts/GitcoinPassportEligibility.sol @@ -1,4 +1,4 @@ -// SPDX-License-Identifier: UNLICENSED +// SPDX-License-Identifier: MIT pragma solidity ^0.8.19; // import { console2 } from "forge-std/Test.sol"; // comment out before deploy @@ -33,11 +33,13 @@ contract GitcoinPassportEligibility is HatsEligibilityModule { * ------------------------------------------------------------------------------+ */ + // @audit This functon does not follow proper naming conventions. /// @notice The Gitcoin Resolver contract function GITCOIN_PASSPORT_DECODER() public pure returns (IGitcoinPassportDecoder) { return IGitcoinPassportDecoder(_getArgAddress(72)); } + // @audit This functon does not follow proper naming conventions. /// @notice The minimum Gitcoin Passport score required to be eligible for a hat, with 4 decimal places function SCORE_CRITERION() public pure returns (uint256) { return _getArgUint256(92) * 10 ** 4; @@ -59,6 +61,8 @@ contract GitcoinPassportEligibility is HatsEligibilityModule { HATS ELIGIBILITY FUNCTION //////////////////////////////////////////////////////////////*/ + // @audit Parameter does not follow proper naming convention. + // @audit Function visbility can be altered to external. /// @inheritdoc IHatsEligibility function getWearerStatus(address _wearer, uint256 /*_hatId*/ ) public