Cask Audit 2

As the function `processWorkUnit` implementation, DCA is paused when `dca.numSkips >= maxSkips`. ```solidity=163 if (maxSkips > 0 && dca.numSkips >= maxSkips) { caskDCA.managerCommand(_dcaId, ICaskDCA.ManagerCommand.Pause); } ``` But in the logic branch `_checkMinMaxPrice`, DCA is only skipped without checking maxSkips and returned. ```solidity=139 if (!_checkMinMaxPrice(_dcaId, inputAsset, outputAsset)) { scheduleWorkUnit(_queueId, _dcaId, bucketAt(dca.processAt + dca.period)); try caskVault.protocolPayment(dca.user, address(this), dcaFeeMin) { caskDCA.managerSkipped(_dcaId, ICaskDCA.SkipReason.OutsideLimits); } catch (bytes memory) { caskDCA.managerCommand(_dcaId, ICaskDCA.ManagerCommand.Cancel); } return; } ``` Thus, if a DCA always could not meet the price restriction in `_checkMinMaxPrice`, it will be skipped and charged `dcaFeeMin` ceaselessly until it's canceled due to the balance running out.

The contract `CaskDCA` `CaskP2P` and `CaskChainlinkTopup`inherit the contract `@openzeppelin/contracts-upgradeable/security/PausableUpgradeable.sol`, but the `paused` flag or `whenPaused`/`whenNotPaused` modifier is not used anywhere in the `CaskDCA`, `CaskP2P` or `CaskChainlinkTopup`. So the function `pause()` and `unpause()` are redundant. The contract `CaskJobQueue` also inherits `PausableUpgradeable.sol` and uses the `whenNotPaused` modifier. However, public or external `pause()` and `unpause()` functions are not implemented.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. The linked code does not zero-check the address when setting `feeDistributor`, regarding the initialization and update of this variable in contract `CaskDCAManager` and `CaskChainlinkTopupManager`. ```solidity=91 feeDistributor = _feeDistributor; ```

`assetsMerkleRoot` is defined but not initialized or used in the contract `CaskDCAManager`.