Spectrum Protocol - Audit

- Contract ·`ERC20MetadataUpgradeable`· extends `ERC20Upgradeable` - contract `EcoERC20Upgradeable`· extends `ERC20PermitUpgradeable` - contract `ERC20MintableUpgradeable`· extends `ERC20Upgradeable` and `ERC20BurnableUpgradeable` - contract `WETH`· extends `ERC20BurnableUpgradeable` - contract `EcoOwnable` extends `Ownable2StepUpgradeable` - contract `SelectorRoleControlUpgradeable` extends `PausableUpgradeable` and `AccessControlEnumerableUpgradeable` - contract `EcoProxyAdmin` extends `MulticallUpgradeable` but these extended contracts are not initialized by the current contracts. Generally, the initializer function of a contract should always call all the initializer functions of the contracts that they extends.

In the functions `_fundReceiveFrom()` and `_stakeReceiveFrom()`, there is no check to ensure that the value retrieved from `$.underlyingToIdx[$.info.fundUnderlying]` exists in the `$.idxAssetList`. This could result in the use of the incorrect `idxAsset` and `idxAmount`, leading to the receipt of incorrect amounts of tokens. ```solidity=211 function _fundReceiveFrom( address requestedAsset, address from, uint256 amount ) internal returns (address idxAsset, uint256 idxAmount) { SpectrumCoreStorage storage $ = _getSpectrumCoreStorage(); if (requestedAsset != $.info.fundUnderlying) revert Spectrum(SpectrumErrors.InValidFund); if (from != _msgSender()) revert Spectrum(SpectrumErrors.InValidFrom); idxAmount = IstETH(payable(requestedAsset)).submit{ value: amount }(address(0)); idxAsset = $.underlyingToIdx[requestedAsset]; IEcoERC20(requestedAsset).safeIncreaseAllowance(idxAsset, idxAmount); idxAmount = IidxAssetWrapper(idxAsset).wrap(idxAmount); } ```