Tegro security record

When baseTokenDecimals would be greater than quoteTokenDecimals the function is unable to calculate the correct totalPrice.Let's say the price is 1e6 (i.e. using quoteTokenDecimals ) and the quantity is 2e18 (i.e. using baseTokenDecimals which is greater than the quoteTokenDecimals). In _calculateTotalPrice() L261 would be executed where it will calculate the price with 1e6 * 10 ** (18 - 6) which would be 1000000000000000000 Now, on L265 it will set totalPrice = 1000000000000000000 * 2e18 = 2000000000000000000000000000000000000 Then if{} on L268 will execute where it will scale down the totalPrice to remove extra decimals: totalPrice = 2000000000000000000000000000000000000 / 10 ** ( 18 + 6) = 2000000000000  So the calculated totalPrice would be 2000000000000 which is not equal to 2e6. The calculated totalPrice should be 2e6 because if the buyer is buying two tokens with the price 1e6 then the buyer needs to pay only 2e6 for two tokens.

In the proxy implementations _disableInitializers() should be called in the constructors. If not added, malicious users/addresses can call initialize() on the implementation smart contract where they would be able to set certain values that initialize() allowed to set.The severity of impact depends on the contract logic, but it's a good practice to add _disableInitializers() call in the implementation logic.

The expiry timestamp can be added as a part of the buy and sell order, which can be used while creating an order hash. And it can be checked in the settleOrders() that while executing the orders, buyOrder.expiry >= block.timestamp && sellOrder.expiry >= block.timestamp.This will ensure that the order can’t be executed after a specific timeframe. (It should be noted that the functionality of having expiry depends on the business logic.)

In settleOrders() on L98 it checks/requires that buyOrder.price >= sellOrder.price after that in the _transferTokens() on the L192 it sets the smallest value to matchedPrice by using this expression buyOrder.price < sellOrder.price ? buyOrder.price : sellOrder.price; but because it is already checked on L98 the buyOrder.price should be greater than or equal to sellOrder.price, buyOrder.price would be always greater than or equal to sellOrder.price so on L192 the condition will always fail and sellOrder.price will get assigned to the matchedPrice.

settleOrders() contains the comment on the L97 //Require the buy price to always be higher than the sell price. Currently, the required check allows buyOrder.price to be equal to sellOrder.price. So the comment can be changed to //Require the buy price to always be higher than or equal to the sell price.

TegroDEXSettlement and TegroDEX are not using fixed solidity versions. Contracts are using unfixed pragma (^0.8.18 and ^0.8.19), Contracts should be deployed with the same compiler version and flags that they have been tested thoroughly. Using floating pragma does not ensure that the contracts will be deployed with the same version. The most recent compiler version may get selected while deploying a contract which has a higher chance of having bugs in it.

OwnableUpgradeable is getting imported and is getting inherited by the TegroDEXSettlement contract. But no functionality is getting used from the OwnableUpgradeable and it can be removed if it remains unused.