tmp slither post audit

slither ./ --checklist --markdown-root ./ --exclude-dependencies 'npx hardhat compile --force' running Generating typings for: 66 artifacts in dir: src/types for target: ethers-v5 Successfully generated 188 typings! Compiled 59 Solidity files successfully

Summary

• arbitrary-send (1 results) (High)
• controlled-delegatecall (2 results) (High)
• name-reused (3 results) (High)
• shadowing-state (4 results) (High)
• incorrect-equality (5 results) (Medium)
• locked-ether (2 results) (Medium)
• reentrancy-no-eth (1 results) (Medium)
• uninitialized-local (1 results) (Medium)
• unused-return (1 results) (Medium)
• missing-zero-check (14 results) (Low)
• calls-loop (6 results) (Low)
• variable-scope (1 results) (Low)
• reentrancy-benign (7 results) (Low)
• reentrancy-events (12 results) (Low)
• timestamp (10 results) (Low)
• assembly (25 results) (Informational)
• pragma (1 results) (Informational)
• solc-version (58 results) (Informational)
• low-level-calls (13 results) (Informational)
• missing-inheritance (1 results) (Informational)
• naming-convention (52 results) (Informational)
• redundant-statements (2 results) (Informational)
• reentrancy-unlimited-gas (2 results) (Informational)
• too-many-digits (4 results) (Informational)
• unimplemented-functions (2 results) (Informational)
• unused-state (12 results) (Informational)
• constable-states (7 results) (Optimization)
• external-function (37 results) (Optimization)

arbitrary-send

Impact: High Confidence: Medium

• ID-0 GnosisSafe.handlePayment(uint256,uint256,uint256,address,address) sends eth to arbitrary user Dangerous calls:
  • require(bool,string)(receiver.send(payment),GS011)

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L196-L213

controlled-delegatecall

Impact: High Confidence: Medium

• ID-1 TestAvatar.execTransactionFromModule(address,uint256,bytes,uint8) uses delegatecall to a input-controlled function id
  • (success,None) = to.delegatecall(data)

./contracts/mock/TestAvatar.sol#L32-L41

• ID-2 TestAvatar.execTransactionFromModuleReturnData(address,uint256,bytes,uint8) uses delegatecall to a input-controlled function id
  • (success,None) = to.delegatecall(data)

./contracts/mock/TestAvatar.sol#L43-L52

name-reused

Impact: High Confidence: High

• ID-3 IERC165 is re-used:
  • IERC165
  • IERC165

./node_modules/@gnosis.pm/safe-contracts/contracts/interfaces/IERC165.sol#L5-L15

• ID-4 Initializable is re-used:
  • Initializable
  • Initializable

./node_modules/@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol#L57-L138

• ID-5 IERC20 is re-used:
  • IERC20
  • IERC20

./node_modules/@openzeppelin/contracts/token/ERC20/IERC20.sol#L9-L82

shadowing-state

Impact: High Confidence: High

• ID-6 Shares._name shadows:
  • ERC20._name

./contracts/SharesERC20.sol#L24

• ID-7 Shares._symbol shadows:
  • ERC20._symbol

./contracts/SharesERC20.sol#L25

• ID-8 Loot._symbol shadows:
  • ERC20._symbol

./contracts/LootERC20.sol#L17

• ID-9 Loot._name shadows:
  • ERC20._name

./contracts/LootERC20.sol#L16

incorrect-equality

Impact: Medium Confidence: High

• ID-10 Baal.getPriorVotes(address,uint256) uses a dangerous strict equality:
  • cp.fromTimeStamp == timeStamp

./contracts/Baal.sol#L971-L1004

• ID-11 Baal.state(uint32) uses a dangerous strict equality:
  • prop.id == 0

./contracts/Baal.sol#L907-L941

• ID-12 Baal._safeTransfer(address,address,uint256) uses a dangerous strict equality:
  • require(bool,string)(success && (data.length == 0 || abi.decode(data,(bool))),transfer failed)

./contracts/Baal.sol#L1074-L1089

• ID-13 Baal.state(uint32) uses a dangerous strict equality:
  • prop.votingStarts == 0

./contracts/Baal.sol#L907-L941

• ID-14 Shares._writeCheckpoint(address,uint256,uint256,uint256) uses a dangerous strict equality:
  • nCheckpoints != 0 && getCheckpoint(delegatee,nCheckpoints - 1).fromTimeStamp == timeStamp

./contracts/SharesERC20.sol#L314-L339

locked-ether

Impact: Medium Confidence: High

• ID-15 Contract locking ether found: Contract MultiSend has payable functions:
  • MultiSend.multiSend(bytes) But does not have a function to withdraw the ether

./node_modules/@gnosis.pm/safe-contracts/contracts/libraries/MultiSend.sol#L9-L66

• ID-16 Contract locking ether found: Contract GnosisSafeProxy has payable functions:
  • GnosisSafeProxy.fallback() But does not have a function to withdraw the ether

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxy.sol#L13-L44

reentrancy-no-eth

Impact: Medium Confidence: Medium

• ID-17 Reentrancy in Baal.processProposal(uint32,bytes): External calls:
  • success = processActionProposal(proposalData)
    • IGuard(guard).checkTransaction(to,value,data,operation,0,0,0,address(0),address(0),bytes(0x),msg.sender)
    • success = IAvatar(target).execTransactionFromModule(to,value,data,operation)
    • IGuard(guard).checkAfterExecution(bytes32(0x),success) State variables written after the call(s):
  • prop.status[3] = true

./contracts/Baal.sol#L538-L596

uninitialized-local

Impact: Medium Confidence: Medium

• ID-18 Baal._ragequit(address,uint256,uint256,address[]).i is a local variable never initialized

./contracts/Baal.sol#L692

unused-return

Impact: Medium Confidence: Medium

• ID-19 TributeMinion.submitTributeProposal(Baal,address,uint256,uint256,uint256,uint32,string) ignores return value by baal.submitProposal(encodedProposal,expiration,0,details)

./contracts/tools/TributeMinion.sol#L96-L123

missing-zero-check

Impact: Low Confidence: Medium

• ID-20 TestAvatar.execTransactionFromModule(address,uint256,bytes,uint8).to lacks a zero-check on : - (success,None) = to.delegatecall(data) - (success,None) = to.call{value: value}(data)

./contracts/mock/TestAvatar.sol#L33

• ID-21 TestAvatar.execTransactionFromModuleReturnData(address,uint256,bytes,uint8).to lacks a zero-check on : - (success,None) = to.delegatecall(data) - (success,returnData) = to.call{value: value}(data)

./contracts/mock/TestAvatar.sol#L44

• ID-22 TestAvatar.enableModule(address)._module lacks a zero-check on : - module = _module

./contracts/mock/TestAvatar.sol#L16

• ID-23 Baal.setUp(bytes)._multisendLibrary lacks a zero-check on : - multisendLibrary = _multisendLibrary

./contracts/Baal.sol#L302

• ID-24 BaalSummoner.constructor(address,address,address,address,address,address,address,address)._gnosisSingleton lacks a zero-check on : - gnosisSingleton = _gnosisSingleton

./contracts/Baal.sol#L1125

• ID-25 BaalSummoner.constructor(address,address,address,address,address,address,address,address)._lootSingleton lacks a zero-check on : - lootSingleton = _lootSingleton

./contracts/Baal.sol#L1130

• ID-26 Baal.setUp(bytes)._avatar lacks a zero-check on : - avatar = _avatar - target = _avatar

./contracts/Baal.sol#L303

• ID-27 BaalSummoner.constructor(address,address,address,address,address,address,address,address)._template lacks a zero-check on : - template = _template

./contracts/Baal.sol#L1124

• ID-28 Module.setAvatar(address)._avatar lacks a zero-check on : - avatar = _avatar

./node_modules/@gnosis.pm/zodiac/contracts/core/Module.sol#L23

• ID-29 Module.setTarget(address)._target lacks a zero-check on : - target = _target

./node_modules/@gnosis.pm/zodiac/contracts/core/Module.sol#L31

• ID-30 Baal.executeAsBaal(address,uint256,bytes)._to lacks a zero-check on : - (success) = _to.call{value: _value}(_data)

./contracts/Baal.sol#L637

• ID-31 BaalSummoner.constructor(address,address,address,address,address,address,address,address)._gnosisMultisendLibrary lacks a zero-check on : - gnosisMultisendLibrary = _gnosisMultisendLibrary

./contracts/Baal.sol#L1127

• ID-32 BaalSummoner.constructor(address,address,address,address,address,address,address,address)._sharesSingleton lacks a zero-check on : - sharesSingleton = _sharesSingleton

./contracts/Baal.sol#L1131

• ID-33 BaalSummoner.constructor(address,address,address,address,address,address,address,address)._gnosisFallbackLibrary lacks a zero-check on : - gnosisFallbackLibrary = _gnosisFallbackLibrary

./contracts/Baal.sol#L1126

calls-loop

Impact: Low Confidence: Medium

• ID-34 Baal._mintShares(address,uint256) has external calls inside a loop: sharesToken.mint(to,shares)

./contracts/Baal.sol#L803-L805

• ID-35 Baal._mintLoot(address,uint256) has external calls inside a loop: lootToken.mint(to,loot)

./contracts/Baal.sol#L843-L845

• ID-36 Baal._burnShares(address,uint256) has external calls inside a loop: sharesToken.burn(from,shares)

./contracts/Baal.sol#L823-L825

• ID-37 Baal._burnLoot(address,uint256) has external calls inside a loop: lootToken.burn(from,loot)

./contracts/Baal.sol#L863-L865

• ID-38 Baal.getPriorVotes(address,uint256) has external calls inside a loop: cp = sharesToken.getCheckpoint(account,center)

./contracts/Baal.sol#L971-L1004

• ID-39 GnosisSafe.checkNSignatures(bytes32,bytes,bytes,uint256) has external calls inside a loop: require(bool,string)(ISignatureValidator(currentOwner).isValidSignature(data,contractSignature) == EIP1271_MAGIC_VALUE,GS024)

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L240-L304

variable-scope

Impact: Low Confidence: High

• ID-40 Variable 'ECDSA.tryRecover(bytes32,bytes).r' in ECDSA.tryRecover(bytes32,bytes) potentially used before declaration: r = mload(uint256)(signature + 0x20)

./node_modules/@openzeppelin/contracts/utils/cryptography/ECDSA.sol#L62

reentrancy-benign

Impact: Low Confidence: Medium

• ID-41 Reentrancy in Shares._beforeTokenTransfer(address,address,uint256): External calls:
  • require(bool,string)(from == address(0) || (msg.sender == address(baal) && to == address(0)) || ! baal.sharesPaused(),!transferable) State variables written after the call(s):
  • _moveDelegates(delegates[from],delegates[to],amount)
    • checkpoints[delegatee][nCheckpoints] = Checkpoint(timeStamp,newVotes)
  • delegates[to] = to
  • _moveDelegates(delegates[from],delegates[to],amount)
    • numCheckpoints[delegatee] = nCheckpoints + 1

./contracts/SharesERC20.sol#L192-L210

• ID-42 Reentrancy in Baal.setUp(bytes): External calls:
  • lootToken.setUp(string(abi.encodePacked(_name, LOOT)),string(abi.encodePacked(_symbol,-LOOT))) State variables written after the call(s):
  • sharesToken = IBaalToken(createClone(_sharesSingleton))

./contracts/Baal.sol#L292-L359

• ID-43 Reentrancy in Baal.setUp(bytes): External calls:
  • lootToken.setUp(string(abi.encodePacked(_name, LOOT)),string(abi.encodePacked(_symbol,-LOOT)))
  • sharesToken.setUp(_name,_symbol) State variables written after the call(s):
  • multisendLibrary = _multisendLibrary

./contracts/Baal.sol#L292-L359

• ID-44 Reentrancy in Baal.submitProposal(bytes,uint32,uint256,string): External calls:
  • (_success) = target.call{value: msg.value}() State variables written after the call(s):
  • latestSponsoredProposalId = proposalCount
  • proposalCount ++
  • proposals[proposalCount] = Proposal(proposalCount,latestSponsoredProposalId,uint32(block.timestamp),uint32(block.timestamp) + votingPeriod,uint32(block.timestamp) + votingPeriod + gracePeriod,expiration,baalGas,0,0,0,(false,false,false,false),msg.sender,proposalDataHash,details)
  • proposals[proposalCount] = Proposal(proposalCount,0,0,0,0,expiration,baalGas,0,0,0,(false,false,false,false),address(0),proposalDataHash,details)

./contracts/Baal.sol#L368-L431

• ID-45 Reentrancy in Shares.transferFrom(address,address,uint256): External calls:
  • _transfer(from,to,amount)
    • require(bool,string)(from == address(0) || (msg.sender == address(baal) && to == address(0)) || ! baal.sharesPaused(),!transferable) State variables written after the call(s):
  • _approve(from,msg.sender,currentAllowance - amount)
    • _allowances[owner][spender] = amount

./contracts/SharesERC20.sol#L94-L107

• ID-46 Reentrancy in Loot.transferFrom(address,address,uint256): External calls:
  • _transfer(from,to,amount)
    • require(bool,string)(from == address(0) || (msg.sender == address(baal) && to == address(0)) || ! baal.lootPaused(),!transferable) State variables written after the call(s):
  • _approve(from,msg.sender,currentAllowance - amount)
    • _allowances[owner][spender] = amount

./contracts/LootERC20.sol#L68-L81

• ID-47 Reentrancy in Baal.setUp(bytes): External calls:
  • lootToken.setUp(string(abi.encodePacked(_name, LOOT)),string(abi.encodePacked(_symbol,-LOOT)))
  • sharesToken.setUp(_name,_symbol)
  • require(bool,string)(exec(multisendLibrary,0,_initializationMultisendData,Enum.Operation.DelegateCall),call failure)
    • IGuard(guard).checkTransaction(to,value,data,operation,0,0,0,address(0),address(0),bytes(0x),msg.sender)
    • success = IAvatar(target).execTransactionFromModule(to,value,data,operation)
    • IGuard(guard).checkAfterExecution(bytes32(0x),success) State variables written after the call(s):
  • status = 1

./contracts/Baal.sol#L292-L359

reentrancy-events

Impact: Low Confidence: Medium

• ID-48 Reentrancy in TributeMinion.submitTributeProposal(Baal,address,uint256,uint256,uint256,uint32,string): External calls:
  • baal.submitProposal(encodedProposal,expiration,0,details) Event emitted after the call(s):
  • TributeProposal(address(baal),token,amount,msg.sender,proposalId)

./contracts/tools/TributeMinion.sol#L96-L123

• ID-49 Reentrancy in Baal.setUp(bytes): External calls:
  • lootToken.setUp(string(abi.encodePacked(_name, LOOT)),string(abi.encodePacked(_symbol,-LOOT)))
  • sharesToken.setUp(_name,_symbol)
  • require(bool,string)(exec(multisendLibrary,0,_initializationMultisendData,Enum.Operation.DelegateCall),call failure)
    • IGuard(guard).checkTransaction(to,value,data,operation,0,0,0,address(0),address(0),bytes(0x),msg.sender)
    • success = IAvatar(target).execTransactionFromModule(to,value,data,operation)
    • IGuard(guard).checkAfterExecution(bytes32(0x),success) Event emitted after the call(s):
  • SetupComplete(lootPaused,sharesPaused,gracePeriod,votingPeriod,proposalOffering,quorumPercent,sponsorThreshold,minRetentionPercent,_name,_symbol,totalShares(),totalLoot())

./contracts/Baal.sol#L292-L359

• ID-50 Reentrancy in Loot.transferFrom(address,address,uint256): External calls:
  • _transfer(from,to,amount)
    • require(bool,string)(from == address(0) || (msg.sender == address(baal) && to == address(0)) || ! baal.lootPaused(),!transferable) Event emitted after the call(s):
  • Approval(owner,spender,amount)
    • _approve(from,msg.sender,currentAllowance - amount)

./contracts/LootERC20.sol#L68-L81

• ID-51 Reentrancy in Shares.transferFrom(address,address,uint256): External calls:
  • _transfer(from,to,amount)
    • require(bool,string)(from == address(0) || (msg.sender == address(baal) && to == address(0)) || ! baal.sharesPaused(),!transferable) Event emitted after the call(s):
  • Approval(owner,spender,amount)
    • _approve(from,msg.sender,currentAllowance - amount)

./contracts/SharesERC20.sol#L94-L107

• ID-52 Reentrancy in Baal.submitProposal(bytes,uint32,uint256,string): External calls:
  • (_success) = target.call{value: msg.value}() Event emitted after the call(s):
  • SubmitProposal(proposalCount,proposalDataHash,votingPeriod,proposalData,expiration,baalGas,selfSponsor,block.timestamp,details)

./contracts/Baal.sol#L368-L431

• ID-53 Reentrancy in ModuleProxyFactory.deployModule(address,bytes,uint256): External calls:
  • (success) = proxy.call(initializer) Event emitted after the call(s):
  • ModuleProxyCreation(proxy,masterCopy)

./node_modules/@gnosis.pm/zodiac/contracts/factory/ModuleProxyFactory.sol#L36-L49

• ID-54 Reentrancy in BaalSummoner.summonBaalAndSafe(bytes,bytes[],uint256): External calls:
  • _baal = Baal(moduleProxyFactory.deployModule(template,_anyCall,_saltNonce))
  • _safe = deployAndSetupSafe(address(_baal),_saltNonce)
    • _safe = GnosisSafe(address(gnosisSafeProxyFactory.createProxy(gnosisSingleton,abi.encodePacked(_saltNonce))))
    • _safe.setup(_owners,1,gnosisMultisendLibrary,_multisendAction,gnosisFallbackLibrary,address(0),0,address(address(0)))
  • _baal.setUp(_initializer) Event emitted after the call(s):
  • SummonBaal(address(_baal),address(_baal.lootToken()),address(_baal.sharesToken()),_safe,false)

./contracts/Baal.sol#L1261-L1305

• ID-55 Reentrancy in Baal.processProposal(uint32,bytes): External calls:
  • success = processActionProposal(proposalData)
    • IGuard(guard).checkTransaction(to,value,data,operation,0,0,0,address(0),address(0),bytes(0x),msg.sender)
    • success = IAvatar(target).execTransactionFromModule(to,value,data,operation)
    • IGuard(guard).checkAfterExecution(bytes32(0x),success) Event emitted after the call(s):
  • ProcessProposal(id,prop.status[2],prop.status[3])

./contracts/Baal.sol#L538-L596

• ID-56 Reentrancy in Shares._beforeTokenTransfer(address,address,uint256): External calls:
  • require(bool,string)(from == address(0) || (msg.sender == address(baal) && to == address(0)) || ! baal.sharesPaused(),!transferable) Event emitted after the call(s):
  • DelegateVotesChanged(delegatee,oldVotes,newVotes)
    • _moveDelegates(delegates[from],delegates[to],amount)

./contracts/SharesERC20.sol#L192-L210

• ID-57 Reentrancy in GnosisSafe.execTransaction(address,uint256,bytes,Enum.Operation,uint256,uint256,uint256,address,address,bytes): External calls:
  • Guard(guard).checkTransaction(to,value,data,operation,safeTxGas,baseGas,gasPrice,gasToken,refundReceiver,signatures,msg.sender) External calls sending eth:
  • payment = handlePayment(gasUsed,baseGas,gasPrice,gasToken,refundReceiver)
    • require(bool,string)(receiver.send(payment),GS011) Event emitted after the call(s):
  • ExecutionFailure(txHash,payment)
  • ExecutionSuccess(txHash,payment)

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L111-L194

• ID-58 Reentrancy in Baal._ragequit(address,uint256,uint256,address[]): External calls:
  • _burnLoot(msg.sender,lootToBurn)
    • lootToken.burn(from,loot)
  • _burnShares(msg.sender,sharesToBurn)
    • sharesToken.burn(from,shares) Event emitted after the call(s):
  • Ragequit(msg.sender,to,lootToBurn,sharesToBurn,tokens)

./contracts/Baal.sol#L674-L712

• ID-59 Reentrancy in BaalSummoner.summonBaal(bytes,bytes[],uint256): External calls:
  • _baal = Baal(moduleProxyFactory.deployModule(template,_anyCall,_saltNonce))
  • _baal.setUp(_initializer) Event emitted after the call(s):
  • SummonBaal(address(_baal),address(_baal.lootToken()),address(_baal.sharesToken()),_safeAddr,true)

./contracts/Baal.sol#L1168-L1212

timestamp

Impact: Low Confidence: Medium

• ID-60 Baal.cancelProposal(uint32) uses timestamp for comparisons Dangerous comparisons:
  • require(bool,string)(msg.sender == prop.sponsor || getPriorVotes(prop.sponsor,block.timestamp - 1) < sponsorThreshold || isGovernor(msg.sender),!cancellable)

./contracts/Baal.sol#L616-L628

• ID-61 Loot.permit(address,address,uint256,uint256,bytes) uses timestamp for comparisons Dangerous comparisons:
  • require(bool,string)(block.timestamp <= deadline,expired)

./contracts/LootERC20.sol#L103-L142

• ID-62 Baal.processProposal(uint32,bytes) uses timestamp for comparisons Dangerous comparisons:
  • prop.expiration != 0 && prop.expiration < block.timestamp

./contracts/Baal.sol#L538-L596

• ID-63 Shares.delegateBySig(address,uint256,uint256,bytes) uses timestamp for comparisons Dangerous comparisons:
  • require(bool,string)(deadline == 0 || deadline < block.timestamp,expired)

./contracts/SharesERC20.sol#L223-L254

• ID-64 Baal.state(uint32) uses timestamp for comparisons Dangerous comparisons:
  • prop.id == 0
  • prop.votingStarts == 0
  • block.timestamp <= prop.votingEnds
  • block.timestamp <= prop.graceEnds
  • prop.noVotes >= prop.yesVotes

./contracts/Baal.sol#L907-L941

• ID-65 Shares.permit(address,address,uint256,uint256,bytes) uses timestamp for comparisons Dangerous comparisons:
  • require(bool,string)(block.timestamp <= deadline,expired)

./contracts/SharesERC20.sol#L146-L185

• ID-66 Baal.getPriorVotes(address,uint256) uses timestamp for comparisons Dangerous comparisons:
  • require(bool,string)(timeStamp < block.timestamp,!determined)
  • sharesToken.getCheckpoint(account,nCheckpoints - 1).fromTimeStamp <= timeStamp
  • sharesToken.getCheckpoint(account,0).fromTimeStamp > timeStamp
  • cp.fromTimeStamp == timeStamp
  • cp.fromTimeStamp < timeStamp

./contracts/Baal.sol#L971-L1004

• ID-67 Shares._writeCheckpoint(address,uint256,uint256,uint256) uses timestamp for comparisons Dangerous comparisons:
  • nCheckpoints != 0 && getCheckpoint(delegatee,nCheckpoints - 1).fromTimeStamp == timeStamp

./contracts/SharesERC20.sol#L314-L339

• ID-68 Baal.sponsorProposal(uint32) uses timestamp for comparisons Dangerous comparisons:
  • require(bool,string)(prop.expiration == 0 || prop.expiration > block.timestamp + votingPeriod + gracePeriod,expired)

./contracts/Baal.sol#L435-L461

• ID-69 Baal.submitProposal(bytes,uint32,uint256,string) uses timestamp for comparisons Dangerous comparisons:
  • require(bool,string)(expiration == 0 || expiration > block.timestamp + votingPeriod + gracePeriod,expired)

./contracts/Baal.sol#L368-L431

assembly

Impact: Informational Confidence: High

• ID-70 StorageAccessible.simulateAndRevert(address,bytes) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/common/StorageAccessible.sol#L36-L46

• ID-71 GuardManager.setGuard(address) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/base/GuardManager.sol#L34-L41

• ID-72 MultiSend.multiSend(bytes) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/libraries/MultiSend.sol#L26-L65

• ID-73 ECDSA.tryRecover(bytes32,bytes) uses assembly
  • INLINE ASM
  • INLINE ASM

./node_modules/@openzeppelin/contracts/utils/cryptography/ECDSA.sol#L57-L88

• ID-74 CompatibilityFallbackHandler.simulate(address,bytes) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L87-L143

• ID-75 Address.verifyCallResult(bool,bytes,string) uses assembly
  • INLINE ASM

./node_modules/@openzeppelin/contracts/utils/Address.sol#L201-L221

• ID-76 console._sendLogPayload(bytes) uses assembly
  • INLINE ASM

./node_modules/hardhat/console.sol#L7-L14

• ID-77 GnosisSafeProxyFactory.createProxy(address,bytes) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L15-L25

• ID-78 Executor.execute(address,uint256,bytes,Enum.Operation,uint256) uses assembly
  • INLINE ASM
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/base/Executor.sol#L8-L26

• ID-79 GnosisSafeProxy.fallback() uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxy.sol#L26-L43

• ID-80 SecuredTokenTransfer.transferToken(address,address,uint256) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/common/SecuredTokenTransfer.sol#L11-L34

• ID-81 FallbackManager.fallback() uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/base/FallbackManager.sol#L32-L52

• ID-82 GnosisSafe.checkNSignatures(bytes32,bytes,bytes,uint256) uses assembly
  • INLINE ASM
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L240-L304

• ID-83 GnosisSafeProxyFactory.createProxyWithNonce(address,bytes,uint256) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L61-L75

• ID-84 ModuleManager.execTransactionFromModuleReturnData(address,uint256,bytes,Enum.Operation) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/base/ModuleManager.sol#L80-L101

• ID-85 ModuleManager.getModulesPaginated(address,uint256) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/base/ModuleManager.sol#L114-L132

• ID-86 GnosisSafe.getChainId() uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L340-L347

• ID-87 ModuleProxyFactory.createProxy(address,bytes32) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/zodiac/contracts/factory/ModuleProxyFactory.sol#L19-L34

• ID-88 StorageAccessible.getStorageAt(uint256,uint256) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/common/StorageAccessible.sol#L13-L23

• ID-89 AddressUpgradeable.verifyCallResult(bool,bytes,string) uses assembly
  • INLINE ASM

./node_modules/@openzeppelin/contracts-upgradeable/utils/AddressUpgradeable.sol#L174-L194

• ID-90 CloneFactory.createClone(address) uses assembly
  • INLINE ASM

./contracts/Baal.sol#L53-L68

• ID-91 GuardManager.getGuard() uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/base/GuardManager.sol#L43-L49

• ID-92 GnosisSafeProxyFactory.deployProxyWithNonce(address,bytes,uint256) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L42-L55

• ID-93 SignatureDecoder.signatureSplit(bytes,uint256) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/common/SignatureDecoder.sol#L11-L35

• ID-94 FallbackManager.internalSetFallbackHandler(address) uses assembly
  • INLINE ASM

./node_modules/@gnosis.pm/safe-contracts/contracts/base/FallbackManager.sol#L14-L20

pragma

Impact: Informational Confidence: High

• ID-95 Different versions of Solidity are used:
  • Version used: ['>=0.4.22<0.9.0', '>=0.7.0<0.9.0', '>=0.8.0', '^0.8.0', '^0.8.1', '^0.8.2', '^0.8.7']
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.8.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • >=0.7.0<0.9.0
  • ^0.8.0
  • ^0.8.2
  • ^0.8.1
  • ^0.8.0
  • ^0.8.0
  • ^0.8.2
  • ^0.8.0
  • ^0.8.0
  • ^0.8.0
  • ^0.8.1
  • ^0.8.0
  • ^0.8.0
  • ^0.8.0
  • ^0.8.0
  • >=0.8.0
  • >=0.8.0
  • >=0.8.0
  • ^0.8.7
  • >=0.8.0
  • >=0.8.0
  • >=0.8.0
  • >=0.4.22<0.9.0

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L2

solc-version

Impact: Informational Confidence: High

• ID-96 Pragma version>=0.8.0 allows old versions

./contracts/mock/TestAvatar.sol#L2

• ID-97 Pragma version>=0.8.0 allows old versions

./contracts/tools/Poster.sol#L14

• ID-98 Pragma version>=0.8.0 allows old versions

./contracts/mock/TestERC20.sol#L2

• ID-99 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/common/SelfAuthorized.sol#L2

• ID-100 Pragma version^0.8.0 allows old versions

./node_modules/@openzeppelin/contracts/utils/cryptography/ECDSA.sol#L4

• ID-101 Pragma version^0.8.0 allows old versions

./node_modules/@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol#L4

• ID-102 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/zodiac/contracts/factory/FactoryFriendly.sol#L4

• ID-103 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/zodiac/contracts/core/Module.sol#L4

• ID-104 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/interfaces/ERC721TokenReceiver.sol#L2

• ID-105 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/common/Singleton.sol#L2

• ID-106 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/external/GnosisSafeMath.sol#L2

• ID-107 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/libraries/MultiSend.sol#L2

• ID-108 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/common/Enum.sol#L2

• ID-109 Pragma version^0.8.0 allows old versions

./node_modules/@openzeppelin/contracts/utils/Context.sol#L4

• ID-110 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/interfaces/ERC1155TokenReceiver.sol#L2

• ID-111 Pragma version^0.8.2 allows old versions

./node_modules/@openzeppelin/contracts/proxy/utils/Initializable.sol#L4

• ID-112 Pragma version^0.8.0 allows old versions

./node_modules/@openzeppelin/contracts/utils/Strings.sol#L4

• ID-113 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/common/StorageAccessible.sol#L2

• ID-114 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/base/GuardManager.sol#L2

• ID-115 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/base/FallbackManager.sol#L2

• ID-116 Pragma version>=0.8.0 allows old versions

./contracts/tools/TributeMinion.sol#L2

• ID-117 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/base/ModuleManager.sol#L2

• ID-118 Pragma version>=0.8.0 allows old versions

./contracts/Baal.sol#L10

• ID-119 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L2

• ID-120 Pragma version>=0.8.0 allows old versions

./contracts/interfaces/IBaal.sol#L2

• ID-121 Pragma version^0.8.1 allows old versions

./node_modules/@openzeppelin/contracts/utils/Address.sol#L4

• ID-122 Pragma version>=0.8.0 allows old versions

./node_modules/@gnosis.pm/zodiac/contracts/factory/ModuleProxyFactory.sol#L2

• ID-123 Pragma version^0.8.0 allows old versions

./node_modules/@openzeppelin/contracts-upgradeable/utils/ContextUpgradeable.sol#L4

• ID-124 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/interfaces/ERC777TokensRecipient.sol#L2

• ID-125 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/SignMessage.sol#L2

• ID-126 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/IProxyCreationCallback.sol#L2

• ID-127 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/zodiac/contracts/interfaces/IGuard.sol#L2

• ID-128 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/common/SecuredTokenTransfer.sol#L2

• ID-129 Pragma version^0.8.0 allows old versions

./node_modules/@openzeppelin/contracts/token/ERC20/IERC20.sol#L4

• ID-130 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/zodiac/contracts/guard/Guardable.sol#L2

• ID-131 Pragma version>=0.8.0 allows old versions

./contracts/SharesERC20.sol#L1

• ID-132 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L2

• ID-133 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L2

• ID-134 Pragma version^0.8.0 allows old versions

./node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#L4

• ID-135 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/DefaultCallbackHandler.sol#L2

• ID-136 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/base/Executor.sol#L2

• ID-137 Pragma version>=0.8.0 allows old versions

./contracts/LootERC20.sol#L1

• ID-138 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/common/SignatureDecoder.sol#L2

• ID-139 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/zodiac/contracts/interfaces/IAvatar.sol#L4

• ID-140 Pragma version^0.8.0 allows old versions

./node_modules/@openzeppelin/contracts/access/Ownable.sol#L4

• ID-141 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxy.sol#L2

• ID-142 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/interfaces/IERC165.sol#L2

• ID-143 Pragma version^0.8.2 allows old versions

./node_modules/@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol#L4

• ID-144 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/zodiac/contracts/guard/BaseGuard.sol#L2

• ID-145 Pragma version^0.8.0 allows old versions

./node_modules/@openzeppelin/contracts/utils/introspection/IERC165.sol#L4

• ID-146 Pragma version^0.8.1 allows old versions

./node_modules/@openzeppelin/contracts-upgradeable/utils/AddressUpgradeable.sol#L4

• ID-147 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/common/EtherPaymentFallback.sol#L2

• ID-148 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L2

• ID-149 Pragma version>=0.8.0 allows old versions

./contracts/mock/MockBaal.sol#L2

• ID-150 Pragma version^0.8.0 allows old versions

./node_modules/@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol#L4

• ID-151 Pragma version>=0.4.22<0.9.0 is too complex

./node_modules/hardhat/console.sol#L2

• ID-152 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L2

• ID-153 Pragma version>=0.7.0<0.9.0 is too complex

./node_modules/@gnosis.pm/safe-contracts/contracts/interfaces/ISignatureValidator.sol#L2

low-level-calls

Impact: Informational Confidence: High

• ID-154 Low level call in TestAvatar.execTransactionFromModule(address,uint256,bytes,uint8):
  • (success,None) = to.delegatecall(data)
  • (success,None) = to.call{value: value}(data)

./contracts/mock/TestAvatar.sol#L32-L41

• ID-155 Low level call in TestAvatar.execTransactionFromModuleReturnData(address,uint256,bytes,uint8):
  • (success,None) = to.delegatecall(data)
  • (success,returnData) = to.call{value: value}(data)

./contracts/mock/TestAvatar.sol#L43-L52

• ID-156 Low level call in AddressUpgradeable.functionCallWithValue(address,bytes,uint256,string):
  • (success,returndata) = target.call{value: value}(data)

./node_modules/@openzeppelin/contracts-upgradeable/utils/AddressUpgradeable.sol#L128-L139

• ID-157 Low level call in Baal.executeAsBaal(address,uint256,bytes):
  • (success) = _to.call{value: _value}(_data)

./contracts/Baal.sol#L636-L643

• ID-158 Low level call in ModuleProxyFactory.deployModule(address,bytes,uint256):
  • (success) = proxy.call(initializer)

./node_modules/@gnosis.pm/zodiac/contracts/factory/ModuleProxyFactory.sol#L36-L49

• ID-159 Low level call in AddressUpgradeable.sendValue(address,uint256):
  • (success) = recipient.call{value: amount}()

./node_modules/@openzeppelin/contracts-upgradeable/utils/AddressUpgradeable.sol#L60-L65

• ID-160 Low level call in Baal._ragequit(address,uint256,uint256,address[]):
  • (balanceData) = tokens[i].staticcall(abi.encodeWithSelector(0x70a08231,address(target)))

./contracts/Baal.sol#L674-L712

• ID-161 Low level call in AddressUpgradeable.functionStaticCall(address,bytes,string):
  • (success,returndata) = target.staticcall(data)

./node_modules/@openzeppelin/contracts-upgradeable/utils/AddressUpgradeable.sol#L157-L166

• ID-162 Low level call in Baal.submitProposal(bytes,uint32,uint256,string):
  • (_success) = target.call{value: msg.value}()

./contracts/Baal.sol#L368-L431

• ID-163 Low level call in Address.sendValue(address,uint256):
  • (success) = recipient.call{value: amount}()

./node_modules/@openzeppelin/contracts/utils/Address.sol#L60-L65

• ID-164 Low level call in Address.functionCallWithValue(address,bytes,uint256,string):
  • (success,returndata) = target.call{value: value}(data)

./node_modules/@openzeppelin/contracts/utils/Address.sol#L128-L139

• ID-165 Low level call in Address.functionStaticCall(address,bytes,string):
  • (success,returndata) = target.staticcall(data)

./node_modules/@openzeppelin/contracts/utils/Address.sol#L157-L166

• ID-166 Low level call in Address.functionDelegateCall(address,bytes,string):
  • (success,returndata) = target.delegatecall(data)

./node_modules/@openzeppelin/contracts/utils/Address.sol#L184-L193

missing-inheritance

Impact: Informational Confidence: High

• ID-167 BaseGuard should inherit from Guard

./node_modules/@gnosis.pm/zodiac/contracts/guard/BaseGuard.sol#L8-L38

naming-convention

Impact: Informational Confidence: High

• ID-168 Parameter TestAvatar.isModuleEnabled(address)._module is not in mixedCase

./contracts/mock/TestAvatar.sol#L24

• ID-169 Parameter TestAvatar.enableModule(address)._module is not in mixedCase

./contracts/mock/TestAvatar.sol#L16

• ID-170 Parameter TributeMinion.releaseEscrow(address,uint32)._proposalId is not in mixedCase

./contracts/tools/TributeMinion.sol#L125

• ID-171 Parameter Baal.executeAsBaal(address,uint256,bytes)._data is not in mixedCase

./contracts/Baal.sol#L639

• ID-172 Parameter Baal.executeAsBaal(address,uint256,bytes)._value is not in mixedCase

./contracts/Baal.sol#L638

• ID-173 Parameter BaalSummoner.encodeMultisend(bytes[],address)._calls is not in mixedCase

./contracts/Baal.sol#L1146

• ID-174 Parameter GnosisSafe.setup(address[],uint256,address,bytes,address,address,uint256,address)._owners is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L76

• ID-175 Parameter Baal.hashOperation(bytes)._transactions is not in mixedCase

./contracts/Baal.sol#L1055

• ID-176 Parameter GnosisSafeProxyFactory.calculateCreateProxyWithNonceAddress(address,bytes,uint256)._singleton is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L100

• ID-177 Parameter Baal.encodeMultisend(bytes[],address)._calls is not in mixedCase

./contracts/Baal.sol#L268

• ID-178 Parameter Guardable.setGuard(address)._guard is not in mixedCase

./node_modules/@gnosis.pm/zodiac/contracts/guard/Guardable.sol#L19

• ID-179 Parameter BaalSummoner.deployAndSetupSafe(address,uint256)._moduleAddr is not in mixedCase

./contracts/Baal.sol#L1214

• ID-180 Parameter CompatibilityFallbackHandler.isValidSignature(bytes32,bytes)._signature is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L66

• ID-181 Parameter MockBaal.mintLoot(address,uint256)._amount is not in mixedCase

./contracts/mock/MockBaal.sol#L26

• ID-182 Parameter Baal.encodeMultisend(bytes[],address)._target is not in mixedCase

./contracts/Baal.sol#L268

• ID-183 Variable ContextUpgradeable.__gap is not in mixedCase

./node_modules/@openzeppelin/contracts-upgradeable/utils/ContextUpgradeable.sol#L36

• ID-184 Parameter OwnerManager.setupOwners(address[],uint256)._threshold is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L22

• ID-185 Parameter BaalSummoner.summonBaalAndSafe(bytes,bytes[],uint256)._saltNonce is not in mixedCase

./contracts/Baal.sol#L1264

• ID-186 Parameter GnosisSafe.setup(address[],uint256,address,bytes,address,address,uint256,address)._threshold is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L77

• ID-187 Parameter Module.setTarget(address)._target is not in mixedCase

./node_modules/@gnosis.pm/zodiac/contracts/core/Module.sol#L31

• ID-188 Parameter OwnerManager.changeThreshold(uint256)._threshold is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L117

• ID-189 Function OwnableUpgradeable.__Ownable_init() is not in mixedCase

./node_modules/@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol#L29-L31

• ID-190 Parameter GnosisSafeProxyFactory.createProxyWithCallback(address,bytes,uint256,IProxyCreationCallback)._singleton is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L83

• ID-191 Contract console is not in CapWords

./node_modules/hardhat/console.sol#L4-L1532

• ID-192 Parameter MockBaal.mintLoot(address,uint256)._to is not in mixedCase

./contracts/mock/MockBaal.sol#L26

• ID-193 Parameter OwnerManager.addOwnerWithThreshold(address,uint256)._threshold is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L51

• ID-194 Variable OwnableUpgradeable.__gap is not in mixedCase

./node_modules/@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol#L94

• ID-195 Parameter OwnerManager.removeOwner(address,address,uint256)._threshold is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L73

• ID-196 Parameter GnosisSafe.encodeTransactionData(address,uint256,bytes,Enum.Operation,uint256,uint256,uint256,address,address,uint256)._nonce is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L375

• ID-197 Parameter Baal.executeAsBaal(address,uint256,bytes)._to is not in mixedCase

./contracts/Baal.sol#L637

• ID-198 Parameter GnosisSafeProxyFactory.deployProxyWithNonce(address,bytes,uint256)._singleton is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L43

• ID-199 Parameter BaalSummoner.deployAndSetupSafe(address,uint256)._saltNonce is not in mixedCase

./contracts/Baal.sol#L1214

• ID-200 Function ContextUpgradeable.__Context_init_unchained() is not in mixedCase

./node_modules/@openzeppelin/contracts-upgradeable/utils/ContextUpgradeable.sol#L21-L22

• ID-201 Parameter Baal.setShamans(address[],uint256[])._permissions is not in mixedCase

./contracts/Baal.sol#L722

• ID-202 Parameter OwnerManager.setupOwners(address[],uint256)._owners is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L22

• ID-203 Parameter TributeMinion.releaseEscrow(address,uint32)._baal is not in mixedCase

./contracts/tools/TributeMinion.sol#L125

• ID-204 Parameter BaalSummoner.summonBaal(bytes,bytes[],uint256)._saltNonce is not in mixedCase

./contracts/Baal.sol#L1171

• ID-205 Parameter Baal.setGovernanceConfig(bytes)._governanceConfig is not in mixedCase

./contracts/Baal.sol#L869

• ID-206 Parameter CompatibilityFallbackHandler.isValidSignature(bytes32,bytes)._dataHash is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L66

• ID-207 Parameter GnosisSafe.getTransactionHash(address,uint256,bytes,Enum.Operation,uint256,uint256,uint256,address,address,uint256)._nonce is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L418

• ID-208 Parameter Module.setAvatar(address)._avatar is not in mixedCase

./node_modules/@gnosis.pm/zodiac/contracts/core/Module.sol#L23

• ID-209 Parameter CompatibilityFallbackHandler.isValidSignature(bytes,bytes)._signature is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L28

• ID-210 Function OwnableUpgradeable.__Ownable_init_unchained() is not in mixedCase

./node_modules/@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol#L33-L35

• ID-211 Parameter SignMessageLib.signMessage(bytes)._data is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/SignMessage.sol#L20

• ID-212 Parameter BaalSummoner.encodeMultisend(bytes[],address)._target is not in mixedCase

./contracts/Baal.sol#L1146

• ID-213 Parameter Baal.setShamans(address[],uint256[])._shamans is not in mixedCase

./contracts/Baal.sol#L721

• ID-214 Parameter Baal.setUp(bytes)._initializationParams is not in mixedCase

./contracts/Baal.sol#L292

• ID-215 Parameter CompatibilityFallbackHandler.isValidSignature(bytes,bytes)._data is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L28

• ID-216 Parameter MockBaal.burnLoot(address,uint256)._from is not in mixedCase

./contracts/mock/MockBaal.sol#L30

• ID-217 Function ContextUpgradeable.__Context_init() is not in mixedCase

./node_modules/@openzeppelin/contracts-upgradeable/utils/ContextUpgradeable.sol#L18-L19

• ID-218 Parameter MockBaal.burnLoot(address,uint256)._amount is not in mixedCase

./contracts/mock/MockBaal.sol#L30

• ID-219 Parameter GnosisSafeProxyFactory.createProxyWithNonce(address,bytes,uint256)._singleton is not in mixedCase

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L62

redundant-statements

Impact: Informational Confidence: High

• ID-220 Redundant expression "calldataPayload" inCompatibilityFallbackHandler

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L92

• ID-221 Redundant expression "targetContract" inCompatibilityFallbackHandler

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L91

reentrancy-unlimited-gas

Impact: Informational Confidence: Medium

• ID-222 Reentrancy in GnosisSafe.execTransaction(address,uint256,bytes,Enum.Operation,uint256,uint256,uint256,address,address,bytes): External calls:
  • payment = handlePayment(gasUsed,baseGas,gasPrice,gasToken,refundReceiver)
    • require(bool,string)(receiver.send(payment),GS011) Event emitted after the call(s):
  • ExecutionFailure(txHash,payment)
  • ExecutionSuccess(txHash,payment)

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L111-L194

• ID-223 Reentrancy in GnosisSafe.setup(address[],uint256,address,bytes,address,address,uint256,address): External calls:
  • handlePayment(payment,0,1,paymentToken,paymentReceiver)
    • require(bool,string)(receiver.send(payment),GS011) Event emitted after the call(s):
  • SafeSetup(msg.sender,_owners,_threshold,to,fallbackHandler)

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L75-L97

too-many-digits

Impact: Informational Confidence: Medium

• ID-224 console.slitherConstructorConstantVariables() uses literals with too many digits:
  • CONSOLE_ADDRESS = address(0x000000000000000000636F6e736F6c652e6c6f67)

./node_modules/hardhat/console.sol#L4-L1532

• ID-225 CloneFactory.createClone(address) uses literals with too many digits:
  • mstore(uint256,uint256)(clone_createClone_asm_0,0x3d602d80600a3d3981f3363d3d373d3d3d363d73000000000000000000000000)

./contracts/Baal.sol#L53-L68

• ID-226 CloneFactory.createClone(address) uses literals with too many digits:
  • mstore(uint256,uint256)(clone_createClone_asm_0 + 0x28,0x5af43d82803e903d91602b57fd5bf30000000000000000000000000000000000)

./contracts/Baal.sol#L53-L68

• ID-227 GnosisSafeProxy.fallback() uses literals with too many digits:
  • calldataload(uint256)(0) == 0xa619486e00000000000000000000000000000000000000000000000000000000

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxy.sol#L26-L43

unimplemented-functions

Impact: Informational Confidence: High

• ID-228 CompatibilityFallbackHandler does not implement functions:
  • DefaultCallbackHandler.onERC1155BatchReceived(address,address,uint256[],uint256[],bytes)
  • DefaultCallbackHandler.onERC1155Received(address,address,uint256,uint256,bytes)
  • DefaultCallbackHandler.onERC721Received(address,address,uint256,bytes)
  • DefaultCallbackHandler.supportsInterface(bytes4)
  • DefaultCallbackHandler.tokensReceived(address,address,address,uint256,bytes,bytes)

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L10-L144

• ID-229 BaseGuard does not implement functions:
  • BaseGuard.checkAfterExecution(bytes32,bool)
  • BaseGuard.checkTransaction(address,uint256,bytes,Enum.Operation,uint256,uint256,uint256,address,address,bytes,address)

./node_modules/@gnosis.pm/zodiac/contracts/guard/BaseGuard.sol#L8-L38

unused-state

Impact: Informational Confidence: High

• ID-230 OwnableUpgradeable.__gap is never used in Baal

./node_modules/@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol#L94

• ID-231 GnosisSafeStorage.domainSeparator is never used in SignMessageLib

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L18

• ID-232 GnosisSafeStorage.nonce is never used in SignMessageLib

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L17

• ID-233 GnosisSafeStorage.owners is never used in SignMessageLib

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L12

• ID-234 GnosisSafeStorage.ownerCount is never used in SignMessageLib

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L13

• ID-235 Singleton.singleton is never used in GnosisSafe

./node_modules/@gnosis.pm/safe-contracts/contracts/common/Singleton.sol#L10

• ID-236 GnosisSafeStorage.approvedHashes is never used in SignMessageLib

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L20

• ID-237 GnosisSafe._deprecatedDomainSeparator is never used in GnosisSafe

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L52

• ID-238 GnosisSafeStorage.modules is never used in SignMessageLib

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L10

• ID-239 GnosisSafeStorage.threshold is never used in SignMessageLib

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L14

• ID-240 GnosisSafeStorage.singleton is never used in SignMessageLib

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L8

• ID-241 CompatibilityFallbackHandler.SIMULATE_SELECTOR is never used in CompatibilityFallbackHandler

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L16

constable-states

Impact: Optimization Confidence: High

• ID-242 GnosisSafeStorage.ownerCount should be constant

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L13

• ID-243 GnosisSafeStorage.threshold should be constant

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L14

• ID-244 Singleton.singleton should be constant

./node_modules/@gnosis.pm/safe-contracts/contracts/common/Singleton.sol#L10

• ID-245 GnosisSafeStorage.singleton should be constant

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L8

• ID-246 GnosisSafeStorage.nonce should be constant

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L17

• ID-247 GnosisSafe._deprecatedDomainSeparator should be constant

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L52

• ID-248 GnosisSafeStorage.domainSeparator should be constant

./node_modules/@gnosis.pm/safe-contracts/contracts/examples/libraries/GnosisSafeStorage.sol#L18

external-function

Impact: Optimization Confidence: High

• ID-249 multiSend(bytes) should be declared external:
  • MultiSend.multiSend(bytes)

./node_modules/@gnosis.pm/safe-contracts/contracts/libraries/MultiSend.sol#L26-L65

• ID-250 removeOwner(address,address,uint256) should be declared external:
  • OwnerManager.removeOwner(address,address,uint256)

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L70-L86

• ID-251 getOwners() should be declared external:
  • OwnerManager.getOwners()

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L136-L148

• ID-252 getStorageAt(uint256,uint256) should be declared external:
  • StorageAccessible.getStorageAt(uint256,uint256)

./node_modules/@gnosis.pm/safe-contracts/contracts/common/StorageAccessible.sol#L13-L23

• ID-253 execTransaction(address,uint256,bytes,Enum.Operation,uint256,uint256,uint256,address,address,bytes) should be declared external:
  • GnosisSafe.execTransaction(address,uint256,bytes,Enum.Operation,uint256,uint256,uint256,address,address,bytes)

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L111-L194

• ID-254 renounceOwnership() should be declared external:
  • Ownable.renounceOwnership()

./node_modules/@openzeppelin/contracts/access/Ownable.sol#L61-L63

• ID-255 disableModule(address,address) should be declared external:
  • ModuleManager.disableModule(address,address)

./node_modules/@gnosis.pm/safe-contracts/contracts/base/ModuleManager.sol#L47-L54

• ID-256 swapOwner(address,address,address) should be declared external:
  • OwnerManager.swapOwner(address,address,address)

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L94-L111

• ID-257 transferFrom(address,address,uint256) should be declared external:
  • ERC20.transferFrom(address,address,uint256)
  • Loot.transferFrom(address,address,uint256)
  • Shares.transferFrom(address,address,uint256)

./node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#L158-L167

• ID-258 decimals() should be declared external:
  • ERC20.decimals()

./node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#L87-L89

• ID-259 setUp(bytes) should be declared external:
  • Baal.setUp(bytes)
  • FactoryFriendly.setUp(bytes)

./contracts/Baal.sol#L292-L359

• ID-260 getTransactionHash(address,uint256,bytes,Enum.Operation,uint256,uint256,uint256,address,address,uint256) should be declared external:
  • GnosisSafe.getTransactionHash(address,uint256,bytes,Enum.Operation,uint256,uint256,uint256,address,address,uint256)

./node_modules/@gnosis.pm/safe-contracts/contracts/GnosisSafe.sol#L408-L421

• ID-261 getMessageHash(bytes) should be declared external:
  • CompatibilityFallbackHandler.getMessageHash(bytes)

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L43-L45

• ID-262 decreaseAllowance(address,uint256) should be declared external:
  • ERC20.decreaseAllowance(address,uint256)

./node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#L201-L210

• ID-263 transfer(address,uint256) should be declared external:
  • ERC20.transfer(address,uint256)

./node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#L113-L117

• ID-264 increaseAllowance(address,uint256) should be declared external:
  • ERC20.increaseAllowance(address,uint256)

./node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#L181-L185

• ID-265 isModuleEnabled(address) should be declared external:
  • ModuleManager.isModuleEnabled(address)

./node_modules/@gnosis.pm/safe-contracts/contracts/base/ModuleManager.sol#L105-L107

• ID-266 proxyRuntimeCode() should be declared external:
  • GnosisSafeProxyFactory.proxyRuntimeCode()

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L28-L30

• ID-267 isOwner(address) should be declared external:
  • OwnerManager.isOwner(address)

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L130-L132

• ID-268 setTarget(address) should be declared external:
  • Module.setTarget(address)

./node_modules/@gnosis.pm/zodiac/contracts/core/Module.sol#L31-L35

• ID-269 proxyCreationCode() should be declared external:
  • GnosisSafeProxyFactory.proxyCreationCode()

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L33-L35

• ID-270 setFallbackHandler(address) should be declared external:
  • FallbackManager.setFallbackHandler(address)

./node_modules/@gnosis.pm/safe-contracts/contracts/base/FallbackManager.sol#L26-L29

• ID-271 transferOwnership(address) should be declared external:
  • Ownable.transferOwnership(address)

./node_modules/@openzeppelin/contracts/access/Ownable.sol#L69-L72

• ID-272 addOwnerWithThreshold(address,uint256) should be declared external:
  • OwnerManager.addOwnerWithThreshold(address,uint256)

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L51-L62

• ID-273 renounceOwnership() should be declared external:
  • OwnableUpgradeable.renounceOwnership()

./node_modules/@openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol#L66-L68

• ID-274 execTransactionFromModuleReturnData(address,uint256,bytes,Enum.Operation) should be declared external:
  • ModuleManager.execTransactionFromModuleReturnData(address,uint256,bytes,Enum.Operation)

./node_modules/@gnosis.pm/safe-contracts/contracts/base/ModuleManager.sol#L80-L101

• ID-275 enableModule(address) should be declared external:
  • ModuleManager.enableModule(address)

./node_modules/@gnosis.pm/safe-contracts/contracts/base/ModuleManager.sol#L32-L40

• ID-276 approve(address,uint256) should be declared external:
  • ERC20.approve(address,uint256)

./node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#L136-L140

• ID-277 createProxyWithCallback(address,bytes,uint256,IProxyCreationCallback) should be declared external:
  • GnosisSafeProxyFactory.createProxyWithCallback(address,bytes,uint256,IProxyCreationCallback)

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L82-L91

• ID-278 getThreshold() should be declared external:
  • OwnerManager.getThreshold()

./node_modules/@gnosis.pm/safe-contracts/contracts/base/OwnerManager.sol#L126-L128

• ID-279 symbol() should be declared external:
  • ERC20.symbol()
  • Loot.symbol()
  • Shares.symbol()

./node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#L70-L72

• ID-280 createProxy(address,bytes) should be declared external:
  • GnosisSafeProxyFactory.createProxy(address,bytes)

./node_modules/@gnosis.pm/safe-contracts/contracts/proxies/GnosisSafeProxyFactory.sol#L15-L25

• ID-281 isValidSignature(bytes,bytes) should be declared external:
  • CompatibilityFallbackHandler.isValidSignature(bytes,bytes)
  • ISignatureValidator.isValidSignature(bytes,bytes)

./node_modules/@gnosis.pm/safe-contracts/contracts/handler/CompatibilityFallbackHandler.sol#L28-L38

• ID-282 deployModule(address,bytes,uint256) should be declared external:
  • ModuleProxyFactory.deployModule(address,bytes,uint256)

./node_modules/@gnosis.pm/zodiac/contracts/factory/ModuleProxyFactory.sol#L36-L49

• ID-283 name() should be declared external:
  • ERC20.name()
  • Loot.name()
  • Shares.name()

./node_modules/@openzeppelin/contracts/token/ERC20/ERC20.sol#L62-L64

• ID-284 encodeMultisend(bytes[],address) should be declared external:
  • Baal.encodeMultisend(bytes[],address)

./contracts/Baal.sol#L268-L288

• ID-285 setAvatar(address) should be declared external:
  • Module.setAvatar(address)

./node_modules/@gnosis.pm/zodiac/contracts/core/Module.sol#L23-L27

./ analyzed (66 contracts with 78 detectors), 286 result(s) found