Some functions do not validate their inputs, which can result in unexpected behavior by the contracts. A non-exhaustive list includes: 1. **[FIXED]** `PolygonRootCheckpointManager.polygonInit()`: the two parameters should be non-zero addresses; 2. **[FIXED]** `PolygonChildCheckpointManager.executeRootCheckpointManagerUpdate()`: the parameter should not be `address(0)`. 3. **[FIXED]** `ArbitrumRootCheckpointManager.arbitrumInit()`: the two parameters should be non-zero addresses; 4. **[FIXED]** `OptimismChildCheckpointManager.constructor()`: the parameter `_l2CrossDomainMessenger` should be non-zero address; 5. **[FIXED]** `OptimismRootCheckpointManager.optimismInit()`: the two parameters should be non-zero addresses; 6. **[FIXED]** `CoreChildCheckpointManager.constructor()`: the parameter `_rootCheckpointManager` should be non-zero address; 7. **[FIXED]** `CoreChildCheckpointManager.executeRootCheckpointManagerUpdate()`: the parameter should not be `address(0)`. 8. **[FIXED]** `BridgeDisputeManager.constructor()`: the parameter `_checkpointManager` should be non-zero address; 9. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.bulkWithdraw()`: the arrays `_userTrades` and `_evidences` should have the same length; 10. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.bulkAcceptUpwardTrade()`: the arrays `_tokenTypeIndices` and `_evidences` should have the same length; 11. **[FIXED]** `PheasantNetworkBridgeChild.tokenTransferFrom()`: consider using `""` instead of `new bytes(0)`; 12. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.executeFeeListUpdate()`: a. there is no integrity constraint making sure that in `_newFeeList`: `low <= medium <= high`, `gasPriceTLow <= gasPriceTHigh` and that no new fee value exceeds the max threshold defined for a given `_tokenTypeIndex`; b. the `_tokenTypeIndex` must match an existing token in the system; 13. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.cancelTradeByRelayer()`: there is no max length check for the parameter `_reason`, that could contain malicious code injection; 14. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.constructor()`:
a. the addresses `_bondManager` and `_disputeManager` must be smart contracts.
b. the constraint integrity `_tradeParam.tradeMinimumAmount <= _tradeParam.tradeThreshold` must be respected;
c. `feeList` values should be consistent (e.g. `high` > `low`).
d. `tradableBondRatio` should be equal or greater than a value that satisfies our recommendation. 15. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.executeNetworkSettingUpdate()`: the three lists sent as parameters must have the same non-zero length, and each operation must be in the range [0,1,2]; 16. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.finalizeTradeParamUpdate()`:
a. the constraint integrity `_tradeParam.tradeMinimumAmount <= _tradeParam.tradeThreshold` must be respected;
b. there are no min and max limits for the new value of `withdrawalBlockPeriod`; 17. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.finalizeTokenAddressUpdate()`: it is possible to use a `networkId` with more than 4 digits 18. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.executeTradeParamUpdate()`: the value of the parameter `operation` must be in the range [0,1,2,3]; 19. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.executeManagerUpdate()`:
a. the value of the parameter `operation` must be in the range [0,1];
b. the address `newManager` must be a smart contract; 20. **[ACKNOWLEDGED]** The first element of an `enum` is always zero. It means that an uninitialized variable will match this first element. In functions such as `finalizeNetworkSettingUpdate()`, `finalizeTradeParamUpdate()` or `executeManagerUpdate()`, using an `enum` as parameter can have unexpected effects if the input is wrong (e.g. human error). To minimize this errors, we recommend declaring the first parameter of the `enum` as an "uninitialized" state, and revert if this value is passed to the functions. 21. **[ACKNOWLEDGED]** `PheasantNetworkBridgeChild.newTrade()` should validate that the `_to` parameter is not the zero address. 22. **[ACKNOWLEDGED]** `BondManager.deposit()` and `executeWithdrawBond()` should check that `_amount > 0`.