Vaulty - Goal vault and Time Vault

Proper code comments explain the purpose of functions in the contracts and also about the kind of parameters a function expects as an input value. This is why it is recommended that contracts should have a NATSPEC code format to give a comprehensive meaning to the functions. While there are few comments that explain the data type and few lines of the code, it is not substantial.

State variables that are certain to be updated when called by several functions in the codebase should not be initialized and set to default values in order to save gas.

there are critical functions that allow for the owner to set a whitelist manager and for users to transfer their vaults but these functions fail to check that the addresses being passed as parameters is not a null address. This is also an issue with creating vaults. When users make the null address, it is impossible to claim such vaults afterwards. This is a common issue among both contracts in scope. Affected functions are as follows:• createVault/createGoal • setWhitelistManager • transferVault

Whenever certain significant actions are performed within the contract, it is recommended to emit an event about it. Significant actions such as vault creation, setting the creation fee and updating the whitelist manager. While it is possible to track emitted events made from token contracts when depositing and withdrawing from vaults, event emissions are important to protocol to help track state changes. These functions to emit for are as follows:• createVault/createGoal • setCreationFees • setWhitelistManager