QA Report

[code423n4]

1. L2GraphTokenGateway.finalizeInboundTransfer() does not need to be payable since it checks for zero eth sent in the function call since the function does not allow eth to be sent due to the require check

2. L2GraphTokenGateway.outboundTransfer() does not need to be payable since it checks for zero eth sent in the function call since function does not allow eth to be sent due to the require check

3. Local variable shadowing
   The following are occurrences of local variable shadwing.

• GraphProxy.constructor._admin shadows the function GraphProxyStorage.admin()
• GraphProxy._acceptUpgrade._pendingImplementation shadows the function GraphProxyStorage._pendingImplementation()
• Controller.setPartialPaused._partialPaused shadows Pausable._partialPaused() state vaiable variable
• Controller.setPaused._paused shadows Pausable._paused() state vaiable variable

Recommendation: Rename the local variables that shadow another component.

4. Missing zero address check
   The following are missing checks for zero address to ensure the address state variable is not set to zero address.

Occurrences:

• L2GraphTokenGateway.initialize() - _controller argument
• L1GraphTokenGateway.initialize() - _controller argument
• BridgeEscrow.initialize() - _controller argument

Recommendation: apply necessary checks to ensure zero address is not supplied as input.

5. Use of floating pragma
   The following contracts have a floating pragma set:

• BridgeEscrow.sol
• GraphUpgradeable.sol
• Governed.sol
• Pausable.sol
• L2GraphToken.sol
• GraphProxyAdmin.sol
• GraphProxyStorage.sol
• GraphProxy.sol
• Managed.sol
• GraphTokenUpgradeable.sol
• L2GraphTokenGateway.sol
• L1GraphTokenGateway.sol
• GraphTokenGateway.sol
• IGraphCurationToken.sol
• ICallhookReceiver.sol
• IGraphProxy.sol
• IEpochManager.sol
• IController.sol
• IGraphToken.sol
• IRewardsManager.sol
• IStakingData.sol
• ICuration.sol
• IStaking.sol