Zoksh

The GatewayFactory contract has the variable setFee initialized to 100. From the calculations in _settle() on L112 this would cause 100% of the amount to be deducted as fees, this way preventing the merchant from withdrawing any amounts and transferring all tokens to the gatewayAddr.

In GatewayRoute, function settle() and refund() send is used for transferring the ether. Future changes or forks in Ethereum can result in higher gas fees than send provides. The .send() creates a hard dependency on 2300 gas units being appropriate now but not in the future. This may also affect functionality when a multi-sig wallet is used for such interactions.

The naming convention used in the codebase is not clear and reduces the readability of the entire codebase. The terms manager and merchant are used concurrently but they could refer to different entities.In GatewayFactory, the onlyManager() modifier checks that the caller is the same as the merchantAddr address provided in the Administrable (GatewayAccess) contract. Since the check is for the merchant and not the manager, it can be changed to onlyMerchant(). In GatewayRoute, the onlyMerchant() modifier checks that the caller is the same as the managerAddr address provided in the creation of the GatewayRoute contract. Since the check is for the manager and not the manager, it can be changed to onlyManager().

From GatewayFactory, the creation of a route can happen with createRoute() or deployRoute(). When routes are created using deployRoute() the merchant address and manager address are the same (msg.sender), but with createRoute() the manager can be any value passed in. The issue here is that the merchant no longer has the privileges to call onlyMerchant() functions if a separate manager is set when calling createRoute().