Oikos

The onlyVault modifier in the staking contract is currently ambiguous, allowing both the vault and staking contract to call functions protected by this modifier. This could lead to confusion about which contract is intended to have exclusive access to these functions.

Both LendingVault::mintTokens() and NomaFactory::mintTokens() share the same function selector f0dda65c. This could lead to confusion in logs, tooling, or proxy setups, especially in cases where introspection or low-level calls are involved.

The codebase contains NatSpec comments that do not accurately reflect the corresponding code structures. This mismatch can lead to confusion for devs trying to understand the intended functionality and usage of these structures

The rollLoan function allows borrowers to extend (roll) their loan duration and increase borrow amounts, without any lender-side constraints or approval. There is no restriction on the number of rollovers, total duration, or borrower eligibility.<br>As a result:<br>- Borrowers may infinitely roll their loans<br>- Lenders may be locked into illiquid positions<br>- There is no mechanism for lenders to enforce repayment or liquidation, despite borrower expiry or

Multiple struct definitions in the codebase contain discrepancies between their declared fields and the comments/documentation provided. This creates confusion and increases the likelihood of bugs, misconfigurations, or developer misunderstanding.<br>1. Struct: RewardParams<br>2. Missing: imv, spotPrice, totalSupply, kr<br>3. Unexpected: totalStaked (not mentioned in comment)<br>4. Struct: ProtocolParameters<br>5. Docstring omits: shiftAnchorUpperBips, slideAnchorUpperBips, and all the fee-related fields<br>6. These may be valid additions, but comments should be updated accordingly<br>7. Struct: LiquidityInternalPars<br>8. Docstring doesn’t match the struct at all — likely refers to a different struct entirely<br>9. The struct itself is clear, but needs correct documentation

The _deployNomaToken function in TokenFactory.sol contains a redundant condition that checks if the proxy address is greater than or equal to _token1. This check is unnecessary because the logic of the do...while loop already ensures that this condition will never be true when the loop exits.

There are few modifiers which are not used in contracts.<br>- onlyVault in LendingVault<br><br>The codebase contains several unused functions, variables, and libraries that contribute to unnecessary complexity and potential confusion for developers and auditors. These unused elements can obscure the code's true functionality and make maintenance more challenging.<br><br>- MockNomaTokenRestricted.sol and Bootstrap.sol are unused.<br><br>- In StakingVault.sol, the LiquidityOps library and functions _collectLiquidity and _transferExcessBalance are defined but not used.<br><br>- In NomaFactory.sol, the teamMultiSig address is declared but never set, rendering it ineffective.<br><br>- In Presale.sol, the variables MIN_CONTRIBUTION and MAX_CONTRIBUTION are calculated in the constructor but never used.<br>