Tezoro - Audit

During the audit, the auditors were not able to gain access to the documentation of the project. Detailed documentation could benefit future code reviewers and improve the project's transparency.

Addresses are not validated before assignment or external calls, potentially allowing the use of zero addresses and leading to unexpected behavior or vulnerabilities. For example, transferring tokens to a zero address can result in a permanent loss of those tokens. ```solidity=56 executor1 = _executor1; ``` - `_executor1` is not zero-checked before being used. --- ```solidity=57 executor2 = _executor2; ``` - `_executor2` is not zero-checked before being used.

A reentrancy attack can occur when the contract creates a function that makes an external call to another untrusted contract before resolving any effects. If the attacker can control the untrusted contract, they can make a recursive call back to the original function, repeating interactions that would have otherwise not run after the external call resolved the effects. ### External call(s) ```solidity=98 ERC20(tokenAddress).safeTransferFrom( owner, beneficiary, amountToTransfer ); ``` * This function call executes the following external call(s). * In `SafeERC20._callOptionalReturn`, * `returndata = address(token).functionCall(data,"SafeERC20: low-level call failed")` * In `Address.functionCallWithValue`, * `(success,returndata) = target.call{value: value}(data)` ### State variables written after the call(s) ```solidity=117 state = _state; ``` ```solidity=118 timestamp = block.timestamp + delay; ```