Interswap

QuillAudits20 Mar 2023Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed InterSwap on 20 Mar 2023: 8 findings, 0 critical; none marked fixed.

No open critical findings

Open the report Open InterSwap’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	8	0	0

LowCheck transferFrom allowance subtraction logicOpen

In case someone sets a uint.max allowance then the contract never subtracts the allowance in transferFrom(). transferFrom function only subtracts the allowance when its not set as uint.max value (i.e when its less than uint.max) because of the if statement

LowFloating solidity (pragma solidity ^0.8.24)Open

When specific solidity pragma version is not defined in a solidity program, it could cause the program to be compiled with either outdated or recent compiler, possibly introducing some known and/or undiscovered bugs. It is a good practice to have a locked solidity compiler version to avoid deployed contracts with bugs.

LowLog ln() function will give error on values less than 0Open

In library contracts LogExpMath there is log function ln() which takes int256 means it should not take any values less than 0 but the check which is implemented is: if(a == 0) revert InterswapErrors.OutOfBounds() but it also should revert for values less than 0.

LowNo zero value check for variableOpen

In library contracts FixedPoint file there are functions divUp() and divDown() which take a,b as input parameters but they do not check zero value for b variable as it is used as denominator which might result in 0 value.

LowRedundant functionOpen

getPool() is redundant as pools mapping is public, the compiler automatically creates getter functions for all public state variables.

LowRedundant importOpen

import for InterswapConstants is redundant as anything from InterswapConstants is not getting used in BasePoolFactory

LowUnused function and errorOpen

In the InterswapPool contract, the _updateChecksum function is defined but never used. Same with the UnexpectedFailedMethod error in the BaseRouter. The unused functions add to the contract bytecode size and could increase deployment cost unnecessarily.

LowUse of incorrect errorOpen

Both setDefaultSwapFee() and setSwapFee() functions are checking that if _swapFee is less than InterswapConstants._MIN_FEE_NUMERATOR (99e16) then it reverts the transaction with InterswapErrors.TooBigFee() error which is incorrect as its checking if _swapFee is less and reverting with error that says TooBigFee.