Skip to content

aderyn-feedback.md

Latest commit

 

History

History
77 lines (55 loc) · 3.79 KB

aderyn-feedback.md

File metadata and controls

77 lines (55 loc) · 3.79 KB
Raw

Aderyn Feedback - v0.4.0

This file contains the project feedback for the static-analysis findings reported in aderyn-report.md.

Summary

Severity Issue Status Feedback
High H-1: Arbitrary from Passed to transferFrom False positive The override delegates to the inherited CMTAT/ERC20 allowance-checked implementation.
High H-2: Contract Name Reused in Different Files Acknowledged VersionModule naming overlaps with upstream code in the CMTAT/ submodule, but this repository does not rely on Truffle-style name resolution.
Low L-1: Centralization Risk Acknowledged Admin and snapshot operators are trusted roles by design.
Low L-2: Unsafe ERC20 Operation False positive The code delegates to inherited ERC-20/CMTAT entry points rather than integrating arbitrary third-party tokens.
Low L-3: Unspecific Solidity Pragma Acknowledged Build compiler version is pinned in project config.
Low L-4: PUSH0 Opcode Acknowledged The project explicitly targets evmVersion: prague in Hardhat config.
Low L-5: Modifier Invoked Only Once Acknowledged The modifier improves readability of the bound-token authorization rule.
Low L-6: Empty Block Acknowledged Empty authorization hooks are intentional because access control is enforced via modifiers.
Low L-7: Unchecked Return False positive _grantRole does not return a meaningful value to check.

Detailed Feedback

H-1: Arbitrary from Passed to transferFrom

  • Status: False positive
  • Finding: CMTATInternalSnapshotBase.transferFrom forwards (from, to, value) to CMTATBaseCommon.transferFrom.
  • Feedback: This override is only a passthrough to the inherited CMTAT/ERC-20 implementation. Allowance and authorization checks are performed in the parent implementation, so the override does not introduce a new arbitrary-transfer primitive.

H-2: Contract Name Reused in Different Files

  • Status: Acknowledged
  • Finding: VersionModule is also used in the upstream CMTAT/ codebase.
  • Feedback: CMTAT/ is an external submodule and the project uses Hardhat artifact resolution by full source path rather than Truffle-style name overwriting. The naming overlap is noted, but it is not a practical issue in the current toolchain.

L-1: Centralization Risk

  • Status: Acknowledged
  • Feedback: Snapshot administration is intentionally permissioned. Admin and operator roles are trusted actors in this design.

L-2: Unsafe ERC20 Operation

  • Status: False positive
  • Feedback: The flagged calls are direct dispatches into the inherited CMTAT/ERC-20 implementation, not integrations with arbitrary non-standard external tokens. SafeERC20 is not relevant to these internal ERC-20 entry points.

L-3: Unspecific Solidity Pragma

  • Status: Acknowledged
  • Feedback: The repository compiles with a fixed Solidity version in Hardhat. Broader pragmas are kept for compatibility with the modular/library usage model.

L-4: PUSH0 Opcode

  • Status: Acknowledged
  • Feedback: The project explicitly fixes the target EVM version in Hardhat config, so deployment bytecode expectations are controlled by the build configuration.

L-5: Modifier Invoked Only Once

  • Status: Acknowledged
  • Feedback: onlyBoundToken is used once, but keeping it as a modifier makes the authorization rule clearer than inlining the same guard.

L-6: Empty Block

  • Status: Acknowledged
  • Feedback: The empty hooks are intentional authorization extension points. The modifier performs the actual access-control check.

L-7: Unchecked Return

  • Status: False positive
  • Feedback: _grantRole does not expose a success/failure return value that should be inspected by the caller, so there is nothing to check here.