In the provided QA run the Run semgrep ci --sarif --output=semgrep.sarif || true step has this output:

Scanning 1 file tracked by git with 54 Code rules:
Nothing to scan.
Current version has 0 findings.

It seems there's smth wrong with the workflow setup because nothing was scanned. Pls refactor accordingly and make sure semgrep is run against https://github.com/ubiquity/ubiquity-dollar/tree/development/packages/contracts/src/dollar.

I've pushed a fix that should fix that and scan only files in the packages/contracts/src/dollar directory

QA Run: https://github.com/cohow/ubiquity-dollar/actions/runs/10903661456/job/30259764076#step:5:18

side note: i could not get semgrep ci to correctly run and scan all the files in the directory as it seems to only scan files that have changed since baseline commit so I've used semgrep scan instead for scanning and specifying directory. I believe the results are the same but let me know if there's any difference.

Ok i'm not sure how I missed that but I managed to make it run with semgrep ci which works better, it's currently running on push and pull request I believe

push QA: https://github.com/cohow/ubiquity-dollar/actions/runs/10904764860/job/30261986841#step:5:19
pull QA: https://github.com/cohow/ubiquity-dollar/actions/runs/10904765962/job/30261990853#step:5:22

PR scan uses diff-aware scanning to limit the scan to files changed since baseline commit.

@rndquu 🙂

To sum up there are 2 semgep security related findings.

First (deprecated contract, added it to .semgrepignore):

src/dollar/libraries/LibDollarMintExcess.sol
❯❯❱ solidity.security.no-slippage-check.no-slippage-check
      No slippage check in a Uniswap v2/v3 trade
      Details: https://sg.run/oO8X              
                                                
       79┆ uint256[] memory amounts = _router.swapExactTokensForTokens(
       80┆     amountIn.toUInt(),
       81┆     0,
       82┆     path,
       83┆     address(this),
       84┆     block.timestamp + 100
       85┆ );

Second (added the mocks folder to .semgrepignore):

src/dollar/mocks/MockERC20.sol
❯❯❱ solidity.security.erc20-public-burn.erc20-public-burn
      Anyone can burn tokens of other accounts
      Details: https://sg.run/RJKN            
                                              
       21┆ function burn(address from, uint256 value) public virtual {
       22┆     _burn(from, value);
       23┆ }

@cohow Could you merge cohow#2 ?

Merged.