Neemo / Neemo-Staked-Astar / Aug2024

Hacken4 Sep 2024Files named in the report

Hacken reviewed Neemo Finance (Neemo / Neemo-Staked-Astar / Aug2024) on 4 Sep 2024: 3 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Neemo Finance’s security record

Report hosted on hacken.io.

Trustblock does not review code.

Findings3

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	0	0	3

LowRedundant Storage Reads Leading to Gas OverheadFixed

Reading the same storage variables multiple times in a single function will cost more Gas. In the `setTreasury()` function, `treasury` is read twice from storage. The same for `protocolConfig[Configs.REWARD_FEE]` and `protocolConfig[Configs.MINT_FEE]` in the `setRewardFee()` and `setMintFee()` functions. The same for `currentBatchId` for the `syncPeriod()` and `forceSyncPeriod()` functions. And in the `setStakingDapp()` function, `_staking` memory variable could be emitted instead of `stakingDapp` storage variable. The same can be observed for `isStakingActive` variable in the `setStakingActive()` function.

LowState Variables That Should Be ImmutableFixed

In the `DepositWrapper` contract, the `dappStakingManager` and `wASTR` variables are only updated in the constructor. The same for the `accessController` variable in the `PauseController` contract. The variables to be assigned only in the contract's constructor could be set immutable to reduce Gas cost when reading them.

LowUnused ImportFixed

The `DepositWrapper` contract imports `IERC20` but the import is not used at all. Having unused imports reduces the code readability and increases the complexity.