Nina security record

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

The **require** can be used to check for conditions and throw an exception if the condition is not met. It is better to provide a string message containing details about the error that will be passed back to the caller.

In contract `DividendPayingToken`, the code after a `require(false)` is unreachable, which is redundant and can be removed. ```solidity=633 function _transfer(address from, address to, uint256 value) internal virtual override { require(false); int256 _magCorrection = magnifiedDividendPerShare.mul(value).toInt256Safe(); magnifiedDividendCorrections[from] = magnifiedDividendCorrections[from].add(_magCorrection); magnifiedDividendCorrections[to] = magnifiedDividendCorrections[to].sub(_magCorrection); } ``` In addition, in the `NINA` contract, the check for the `newClaimWait` is performed in the `updateClaimWait` function of the `DividendTracker` contract. ```solidity=1259 function updateClaimWait(uint256 newClaimWait) external onlyOwner { require(newClaimWait >= 3_600 && newClaimWait <= 86_400, "claimWait must be updated to between 1 and 24 hours"); dividendTracker.updateClaimWait(newClaimWait); } ```

The contract is serving as the underlying entity to interact with one or more third party protocols. The scope of the audit treats third party entities as black boxes and assumes their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc. ```solidity=900 IUniswapV2Router02 public uniswapV2Router; ``` - The contract `NINA` interacts with third party contract with `IUniswapV2Router02` interface via `uniswapV2Router`.

The smart contract contains one or more inteface definitions that are not used, which can lead to unnecessary complexity and reduced maintainability. ```solidity=223 interface IUniswapV2Pair { ``` - `IUniswapV2Pair` is declared but never used.

The smart contract does not check or store the return value of an external call in a local or state variable, which may introduce vulnerabilities due to the unhandled outcome. ```solidity=1205 try uniswapV2Router.addLiquidityETH{value: newBalance}( address(this), otherHalf, 0, // slippage is unavoidable 0, // slippage is unavoidable DEAD, block.timestamp ) {} catch {} ``` ```solidity=1320 dividendTracker.processAccount(payable(msg.sender), false); ``` ```solidity=1324 dividendTracker.processAccount(payable(claimee), false); ```

The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.