Bloq

The functions initialize() and updateCollateralFactor() do not account for the possibility of a collateral factor being introduced as either 0 or 1e18, corresponding to 0% or 100%. This effectively means that in some cases throughout the code, divisions will be made using this value that will yield "Division By Zero" errors, therefore reverting the transaction. Ultimately, this may cause a Denial of Service to legitimate users of the smart contract.

The modifier whenNotShutdown is implemented to provide a way for the system's governor to stop all operations during emergencies. However, not all critical functions are protected with this modifier. The functions layer2Leverage(), layer2FlashRepay(), retryLayer2LeverageCallback(), and retryLayer2FlashRepayCallback() do not rely on the protection of the whenNotShutdown modifier and may be used my malicious actors on specific scenarios to damage the entire system.

The function layer2Leverage() does not perform validation on the input variable amountIn_, therefore making it possible for a user to input a zero amount to be transferred. Some tokens do not perform this check intrinsically and may waste gas and blockchain resources if not accounted for by developers.

According to the code workflow implemented on the protocol, the modifier onlyIfSyntheticTokenIsActive being used on the function flashIssue() is not necessary since similar validations are already being made on the same smart contract interaction. This optimizes the code to save on gas during execution.