Merge branch 'la-audit-fixes' of github.com:NeokingdomDAO/contracts i…

…nto la-audit-fixes
NeokingdomDAO · Oct 20, 2023 · 7d7d086 · 7d7d086
2 parents f590a6e + d139cd8
commit 7d7d086
Show file tree

Hide file tree

Showing 40 changed files with 81 additions and 44 deletions.
diff --git a/contracts/GovernanceToken/GovernanceToken.sol b/contracts/GovernanceToken/GovernanceToken.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
 import "@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol";
@@ -46,6 +46,10 @@ contract GovernanceToken is Initializable, HasRole, GovernanceTokenSnapshot {
         string memory name,
         string memory symbol
     ) public initializer {
+        require(
+            address(roles) != address(0),
+            "GovernanceToken: 0x0 not allowed"
+        );
         _initialize(name, symbol);
         _setRoles(roles);
     }

diff --git a/contracts/GovernanceToken/GovernanceTokenBase.sol b/contracts/GovernanceToken/GovernanceTokenBase.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol";
 import "../RedemptionController/IRedemptionController.sol";

diff --git a/contracts/GovernanceToken/GovernanceTokenSnapshot.sol b/contracts/GovernanceToken/GovernanceTokenSnapshot.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/utils/Arrays.sol";
 import "./IGovernanceToken.sol";

diff --git a/contracts/GovernanceToken/IGovernanceToken.sol b/contracts/GovernanceToken/IGovernanceToken.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/token/ERC20/IERC20Upgradeable.sol";
 import "../extensions/ISnapshot.sol";

diff --git a/contracts/InternalMarket/InternalMarket.sol b/contracts/InternalMarket/InternalMarket.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
@@ -22,13 +22,18 @@ contract InternalMarket is Initializable, HasRole, InternalMarketBase {
     /**
      * @dev Initializes the contract with the given roles and internal token.
      * @param roles DAORoles instance containing custom access control roles.
-     * @param tokenInternal_ Reference to governance token.
+     * @param governanceToken Reference to governance token.
      */
     function initialize(
         DAORoles roles,
-        IGovernanceToken tokenInternal_
+        IGovernanceToken governanceToken
     ) public initializer {
-        _initialize(tokenInternal_, 7 days);
+        require(
+            address(roles) != address(0) &&
+                address(governanceToken) != address(0),
+            "InternalMarket: 0x0 not allowed"
+        );
+        _initialize(governanceToken, 7 days);
         _setRoles(roles);
     }
 

diff --git a/contracts/InternalMarket/InternalMarketBase.sol b/contracts/InternalMarket/InternalMarketBase.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
 import "../ShareholderRegistry/IShareholderRegistry.sol";

diff --git a/contracts/NeokingdomToken/INeokingdomToken.sol b/contracts/NeokingdomToken/INeokingdomToken.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/token/ERC20/IERC20.sol";
 

diff --git a/contracts/NeokingdomToken/NeokingdomToken.sol b/contracts/NeokingdomToken/NeokingdomToken.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
 import "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";

diff --git a/contracts/RedemptionController/IRedemptionController.sol b/contracts/RedemptionController/IRedemptionController.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
 import "@openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol";

diff --git a/contracts/RedemptionController/RedemptionController.sol b/contracts/RedemptionController/RedemptionController.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
 import "./RedemptionControllerBase.sol";
@@ -35,6 +35,10 @@ contract RedemptionController is
      * @param roles The addresses of DAORoles for this contract.
      */
     function initialize(DAORoles roles) public initializer {
+        require(
+            address(roles) != address(0),
+            "RedemptionController: 0x0 not allowed"
+        );
         _setRoles(roles);
         _initialize();
     }

diff --git a/contracts/RedemptionController/RedemptionControllerBase.sol b/contracts/RedemptionController/RedemptionControllerBase.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "./IRedemptionController.sol";
 

diff --git a/contracts/ResolutionManager/ResolutionManager.sol b/contracts/ResolutionManager/ResolutionManager.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
 import { Roles } from "../extensions/Roles.sol";
@@ -26,6 +26,13 @@ contract ResolutionManager is Initializable, ResolutionManagerBase, HasRole {
         IGovernanceToken governanceToken,
         IVoting voting
     ) public initializer {
+        require(
+            address(roles) != address(0) &&
+                address(shareholderRegistry) != address(0) &&
+                address(governanceToken) != address(0) &&
+                address(voting) != address(0),
+            "ResolutionManager: 0x0 not allowed"
+        );
         _setRoles(roles);
         _initialize(shareholderRegistry, governanceToken, voting);
     }

diff --git a/contracts/ResolutionManager/ResolutionManagerBase.sol b/contracts/ResolutionManager/ResolutionManagerBase.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "../ShareholderRegistry/IShareholderRegistry.sol";
 import "../GovernanceToken/IGovernanceToken.sol";

diff --git a/contracts/ShareholderRegistry/IShareholderRegistry.sol b/contracts/ShareholderRegistry/IShareholderRegistry.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "../extensions/ISnapshot.sol";
 

diff --git a/contracts/ShareholderRegistry/ShareholderRegistry.sol b/contracts/ShareholderRegistry/ShareholderRegistry.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
 import "./ShareholderRegistrySnapshot.sol";
@@ -28,6 +28,10 @@ contract ShareholderRegistry is
         string memory name,
         string memory symbol
     ) public initializer {
+        require(
+            address(roles) != address(0),
+            "ShareholderRegistry: 0x0 not allowed"
+        );
         _initialize(name, symbol);
         _setRoles(roles);
     }

diff --git a/contracts/ShareholderRegistry/ShareholderRegistryBase.sol b/contracts/ShareholderRegistry/ShareholderRegistryBase.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol";
 import "@openzeppelin/contracts/utils/Address.sol";
@@ -84,7 +84,10 @@ contract ShareholderRegistryBase is ERC20Upgradeable {
     ) internal view virtual returns (bool) {
         return
             balance > 0 &&
-            // shareholder < investor < contributor < managing board
+            // investor < contributor < managing board
+            // TODO: shareholder is currently equivalent to investor.
+            // We need to verify with the lawyer whether we can remove it
+            // completely from the smart contracts.
             (status == INVESTOR_STATUS ||
                 status == SHAREHOLDER_STATUS ||
                 status == accountStatus ||

diff --git a/contracts/ShareholderRegistry/ShareholderRegistrySnapshot.sol b/contracts/ShareholderRegistry/ShareholderRegistrySnapshot.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "./ShareholderRegistryBase.sol";
 import "../extensions/Snapshottable.sol";

diff --git a/contracts/Voting/IVoting.sol b/contracts/Voting/IVoting.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "../extensions/ISnapshot.sol";
 

diff --git a/contracts/Voting/Voting.sol b/contracts/Voting/Voting.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";
 import "../ShareholderRegistry/IShareholderRegistry.sol";
@@ -18,6 +18,7 @@ contract Voting is VotingSnapshot, Initializable, HasRole {
      * @param roles Instance of a DAORoles contract.
      */
     function initialize(DAORoles roles) public initializer {
+        require(address(roles) != address(0), "Voting: 0x0 not allowed");
         _setRoles(roles);
     }
 
@@ -95,7 +96,7 @@ contract Voting is VotingSnapshot, Initializable, HasRole {
 
     /**
      * @notice Hook called on every governance token transfer.
-     * @dev Only the governance token can call this method.
+     * @dev Called by GovernanceToken and ShareholderRegistry.
      * @param from The sender's address.
      * @param to The receiver's address.
      * @param amount The amount transferred.

diff --git a/contracts/Voting/VotingBase.sol b/contracts/Voting/VotingBase.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/token/ERC20/IERC20Upgradeable.sol";
 import "../ShareholderRegistry/IShareholderRegistry.sol";

diff --git a/contracts/Voting/VotingSnapshot.sol b/contracts/Voting/VotingSnapshot.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/utils/Arrays.sol";
 import "../extensions/Snapshottable.sol";

diff --git a/contracts/extensions/DAORoles.sol b/contracts/extensions/DAORoles.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/access/AccessControl.sol";
 

diff --git a/contracts/extensions/HasRole.sol b/contracts/extensions/HasRole.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/utils/ContextUpgradeable.sol";
 import "@openzeppelin/contracts/utils/Strings.sol";

diff --git a/contracts/extensions/ISnapshot.sol b/contracts/extensions/ISnapshot.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 interface ISnapshot {
     function snapshot() external returns (uint256);

diff --git a/contracts/extensions/Roles.sol b/contracts/extensions/Roles.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 library Roles {
     bytes32 public constant OPERATOR_ROLE = keccak256("OPERATOR_ROLE");

diff --git a/contracts/extensions/Snapshottable.sol b/contracts/extensions/Snapshottable.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/utils/Arrays.sol";
 

diff --git a/contracts/mocks/ERC20Mock.sol b/contracts/mocks/ERC20Mock.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol";
 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";

diff --git a/contracts/mocks/HasRoleMock.sol b/contracts/mocks/HasRoleMock.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "../extensions/HasRole.sol";
 

diff --git a/contracts/mocks/NeokingdomTokenMock.sol b/contracts/mocks/NeokingdomTokenMock.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 contract GovernanceTokenMock {
     mapping(address => uint256) mockResult_balanceOfAt;

diff --git a/contracts/mocks/NeokingdomTokenV2Mock.sol b/contracts/mocks/NeokingdomTokenV2Mock.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "../GovernanceToken/GovernanceToken.sol";
 import "../extensions/Roles.sol";

diff --git a/contracts/mocks/NewTelediskoTokenMock.sol b/contracts/mocks/NewTelediskoTokenMock.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/utils/Arrays.sol";
 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";

diff --git a/contracts/mocks/ResolutionExecutorMock.sol b/contracts/mocks/ResolutionExecutorMock.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 contract ResolutionExecutorMock {
     event MockExecutionSimple(uint256 a);

diff --git a/contracts/mocks/ResolutionManagerV2Mock.sol b/contracts/mocks/ResolutionManagerV2Mock.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "../ResolutionManager/ResolutionManager.sol";
 import "../extensions/Roles.sol";

diff --git a/contracts/mocks/ShareholderRegistryMock.sol b/contracts/mocks/ShareholderRegistryMock.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "../ShareholderRegistry/IShareholderRegistry.sol";
 import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol";

diff --git a/contracts/mocks/TokenMock.sol b/contracts/mocks/TokenMock.sol
@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
 

diff --git a/contracts/mocks/VotingMock.sol b/contracts/mocks/VotingMock.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 contract VotingMock {
     event AfterTokenTransferCalled(address from, address to, uint256 amount);

diff --git a/echidna/proxies/InternalMarketProxy.sol b/echidna/proxies/InternalMarketProxy.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "./TokenMock.sol";
 import "../../contracts/InternalMarket/InternalMarket.sol";

diff --git a/echidna/proxies/RedemptionControllerProxy.sol b/echidna/proxies/RedemptionControllerProxy.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "../../contracts/RedemptionController/RedemptionController.sol";
 

diff --git a/echidna/proxies/TokenMock.sol b/echidna/proxies/TokenMock.sol
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: MIT
 
-pragma solidity ^0.8.16;
+pragma solidity 0.8.16;
 
 import "@openzeppelin/contracts/token/ERC20/ERC20.sol";