Torque security record

The smart contracts lack NATSpec (Ethereum Natural Language Specification) comments for many functions. NATSpec comments are crucial for providing clear documentation on function purposes, parameters, and return values, which helps improve the readability and usability of the contracts. The absence of these comments makes it harder for developers and users to understand the functions' intentions and how they should be used.

The updateRateMode functions in the RadiantWbtcRefinanceUSDC, RadiantWethRefinanceUSDC, AaveWbtcRefinance, and AaveWethRefinance contracts do not validate the rateMode parameter. Any uint256 value can be provided, potentially breaking the contract interaction with Aave and Radiant if an invalid rate mode is set.

The updateRLendingPool and updateAaveLendingPool functions in the RadiantWbtcRefinanceUSDC and AaveWbtcRefinance contracts, respectively, lack checks to ensure the new lending pool address is not the zero address. This omission can lead to critical issues if a zero address is set, such as causing contract interactions to fail or resulting in loss of functionality.

The contracts currently use string-based error messages in require statements to handle errors. This approach is less efficient and can increase gas costs due to the on-chain storage of strings. Additionally, string-based errors lack the structured handling that custom errors provide, which can lead to less maintainable code.For example, the following code uses string-based error messages: require(usdcAmount > 0, "USDC amount must be greater than 0"); require(rWethAmount > 0, "rWETH amount must be greater than 0"); This practice could be optimized by using custom errors, which are more gas-efficient and provide better structure for error handling.