Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

📝 Spearbit security review notes #1223

Open
Vectorized opened this issue Dec 9, 2024 · 0 comments
Open

📝 Spearbit security review notes #1223

Vectorized opened this issue Dec 9, 2024 · 0 comments

Comments

@Vectorized
Copy link
Owner

Vectorized commented Dec 9, 2024

Past reports:

https://github.com/Enigma-Dark/security-review-reports/blob/main/2024-04-01_Security_Review_Report_Solady_ERC6551.pdf <- Covers ERC6551, LibERC6551, ERC6551Proxy.

https://github.com/zobront/audits/blob/main/reports/sound2.md <- Covers Solady LibMap, EIP712, LibBitmap, Ownable, OwnableRoles.

Suggested priority (high to low), based of a mix of confidence, usage, impact:

./accounts/LibERC7579.sol   New, will be used in account abstraction stuff to safely decode ERC7579 data.
./auth/EnumerableRoles.sol   
./utils/LibClone.sol   New bytecode contracts.
./utils/P256.sol   Cautious of the verifier, which is translated from OZ's implementation.
./accounts/Timelock.sol
./tokens/ERC20Votes.sol   
./utils/LibTransient.sol
./utils/ReentrancyGuardTransient.sol
./utils/Lifebuoy.sol    For the left-curved, such that contracts won't accidentally brick assets.
./utils/MinHeapLib.sol
./utils/WebAuthn.sol    
./utils/RedBlackTreeLib.sol   This could be used for order books, but no one dares.
./utils/ext/delegatexyz/DelegateCheckerLib.sol
./utils/SignatureCheckerLib.sol
./utils/ECDSA.sol    In previous Cantina review. New: optimizations and canonical hash functions.
./utils/SafeTransferLib.sol   New: Permit2 helpers.
./utils/Multicallable.sol   Might still be used these days. 
/utils/DateTimeLib.sol
./utils/Initializable.sol
./utils/UUPSUpgradeable.sol    
./utils/UpgradeableBeacon.sol
./utils/EnumerableSetLib.sol
./utils/EfficientHashLib.sol   Partially autogenerated.
./accounts/ERC7821.sol   ERC still in active development.
./utils/DynamicArrayLib.sol
./utils/DynamicBufferLib.sol
./utils/LibBitmap.sol    Unchanged since last review for Soundxyz.
./utils/FixedPointMathLib.sol   LambertW0Wad is not feasible to formally verify. 
./tokens/ERC20.sol    In previous Cantina Review. New: Permit2 support.
./utils/LibString.sol
./tokens/ERC1155.sol    In previous Cantina Review.
./accounts/ERC6551.sol    In Enigma Dark Review.
./accounts/LibERC6551.sol    In Enigma Dark Review.
./accounts/ERC6551Proxy.sol    In Enigma Dark Review.
./accounts/ERC1271.sol    In Kalos Review for Agent Exchange.
./accounts/ERC4337.sol
./accounts/ERC4337Factory.sol
./accounts/Receiver.sol
./accounts/Timelock.sol
./auth/Ownable.sol   Unchanged since last review for Soundxyz.
./auth/OwnableRoles.sol   Unchanged since last review for Soundxyz.
./utils/SafeCastLib.sol   Autogenerated. You may want to check that the general rule is correct.
./utils/JSONParserLib.sol   For onchain metadata engines for tokenURI.
./utils/SSTORE2.sol
./utils/LibZip.sol   Has been reviewed for OP stack.
./tokens/ERC2981.sol
./tokens/ERC4626.sol
./tokens/ERC6909.sol    
./tokens/ERC721.sol    
./tokens/WETH.sol
./utils/LibBit.sol   
./utils/Base64.sol   
./utils/CREATE3.sol
./utils/DeploylessPredeployQueryer.sol   Offchain.
./utils/EIP712.sol   Unchanged since last review for Soundxyz.
./utils/ERC1967Factory.sol   In previous Cantina review. Unchanged.
./utils/ERC1967FactoryConstants.sol   Just constants.
./utils/EnumerableMapLib.sol   Autogenerated.
./utils/GasBurnerLib.sol   For trolling.
./utils/LibMap.sol   Unchanged since last review for Soundxyz.
./utils/LibPRNG.sol   For onchain PRNG games?
./utils/LibRLP.sol
./utils/LibSort.sol
./utils/MerkleProofLib.sol   Unchanged since last review for Soundxyz.
./utils/MetadataReaderLib.sol   Used in Sablier. 
./utils/ReentrancyGuard.sol
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant