Slither analyzer report and related fixes

[QEDK]

This discussion seeks to find an optimal way to resolve most or all of the issues reported by slither
The initial report is as follows:

DummyProgramFactory.updateProgramContract(address)._programContract (contracts/dummy/upgradeCheck/dummyProgramFactory.sol#36) lacks a zero-check on :
		- programContract = _programContract (contracts/dummy/upgradeCheck/dummyProgramFactory.sol#37)
DummyRoundFactory.updateRoundContract(address)._RoundContract (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#53) lacks a zero-check on :
		- RoundContract = _RoundContract (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#54)
ProgramFactory.updateProgramContract(address)._programContract (contracts/program/ProgramFactory.sol#37) lacks a zero-check on :
		- programContract = _programContract (contracts/program/ProgramFactory.sol#38)
RoundFactory.updateRoundContract(address)._RoundContract (contracts/round/RoundFactory.sol#50) lacks a zero-check on :
		- RoundContract = _RoundContract (contracts/round/RoundFactory.sol#51)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#missing-zero-address-validation

Reentrancy in DummyProgramFactory.create(bytes,string) (contracts/dummy/upgradeCheck/dummyProgramFactory.sol#47-61):
	External calls:
	- DummyProgramImplementation(clone).initialize(_encodedParameters,foobar) (contracts/dummy/upgradeCheck/dummyProgramFactory.sol#56)
	Event emitted after the call(s):
	- ProgramCreated(clone) (contracts/dummy/upgradeCheck/dummyProgramFactory.sol#58)
Reentrancy in DummyRoundFactory.create(bytes,address,string) (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#65-82):
	External calls:
	- DummyRoundImplementation(_clone).initialize(_encodedParameters,_foobar) (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#74-77)
	Event emitted after the call(s):
	- RoundCreated(_clone,_ownedBy) (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#79)
Reentrancy in ProgramFactory.create(bytes) (contracts/program/ProgramFactory.sol#48-59):
	External calls:
	- ProgramImplementation(clone).initialize(_encodedParameters) (contracts/program/ProgramFactory.sol#54)
	Event emitted after the call(s):
	- ProgramCreated(clone) (contracts/program/ProgramFactory.sol#56)
Reentrancy in RoundFactory.create(bytes,address) (contracts/round/RoundFactory.sol#62-76):
	External calls:
	- RoundImplementation(_clone).initialize(_encodedParameters) (contracts/round/RoundFactory.sol#69-71)
	Event emitted after the call(s):
	- RoundCreated(_clone,_ownedBy) (contracts/round/RoundFactory.sol#73)
Reentrancy in BulkVotingStrategy.vote(bytes[],address) (contracts/votingStrategy/BulkVotingStrategy.sol#40-66):
	External calls:
	- SafeERC20.safeTransferFrom(IERC20(_token),_voterAddress,_grantAddress,_amount) (contracts/votingStrategy/BulkVotingStrategy.sol#49-54)
	Event emitted after the call(s):
	- Voted(IERC20(_token),_amount,_voterAddress,_grantAddress,msg.sender) (contracts/votingStrategy/BulkVotingStrategy.sol#57-63)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#reentrancy-vulnerabilities-3

DummyRoundImplementation.initialize(bytes,string) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#107-173) uses timestamp for comparisons
	Dangerous comparisons:
	- require(bool,string)(_applicationsStartTime >= block.timestamp,initialize: applications start time has already passed) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#140)
DummyRoundImplementation.updateRoundStartTime(uint256) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#195-204) uses timestamp for comparisons
	Dangerous comparisons:
	- require(bool,string)(_newRoundStartTime >= block.timestamp,updateRoundStartTime: start time has already passed) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#197)
DummyRoundImplementation.updateRoundEndTime(uint256) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#208-217) uses timestamp for comparisons
	Dangerous comparisons:
	- require(bool,string)(_newRoundEndTime >= block.timestamp,updateRoundEndTime: end time has already passed) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#210)
DummyRoundImplementation.updateApplicationsStartTime(uint256) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#221-230) uses timestamp for comparisons
	Dangerous comparisons:
	- require(bool,string)(_newApplicationsStartTime >= block.timestamp,updateApplicationsStartTime: application start time has already passed) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#223)
DummyRoundImplementation.updateApplicationsEndTime(uint256) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#234-243) uses timestamp for comparisons
	Dangerous comparisons:
	- require(bool,string)(_newApplicationsEndTime >= block.timestamp,updateApplicationsEndTime: application end time has already passed) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#236)
RoundImplementation.initialize(bytes) (contracts/round/RoundImplementation.sol#104-167) uses timestamp for comparisons
	Dangerous comparisons:
	- require(bool,string)(_applicationsStartTime >= block.timestamp,initialize: applications start time has already passed) (contracts/round/RoundImplementation.sol#134)
RoundImplementation.updateRoundStartTime(uint256) (contracts/round/RoundImplementation.sol#189-198) uses timestamp for comparisons
	Dangerous comparisons:
	- require(bool,string)(_newRoundStartTime >= block.timestamp,updateRoundStartTime: start time has already passed) (contracts/round/RoundImplementation.sol#191)
RoundImplementation.updateRoundEndTime(uint256) (contracts/round/RoundImplementation.sol#202-211) uses timestamp for comparisons
	Dangerous comparisons:
	- require(bool,string)(_newRoundEndTime >= block.timestamp,updateRoundEndTime: end time has already passed) (contracts/round/RoundImplementation.sol#204)
RoundImplementation.updateApplicationsStartTime(uint256) (contracts/round/RoundImplementation.sol#215-224) uses timestamp for comparisons
	Dangerous comparisons:
	- require(bool,string)(_newApplicationsStartTime >= block.timestamp,updateApplicationsStartTime: application start time has already passed) (contracts/round/RoundImplementation.sol#217)
RoundImplementation.updateApplicationsEndTime(uint256) (contracts/round/RoundImplementation.sol#228-237) uses timestamp for comparisons
	Dangerous comparisons:
	- require(bool,string)(_newApplicationsEndTime >= block.timestamp,updateApplicationsEndTime: application end time has already passed) (contracts/round/RoundImplementation.sol#230)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#block-timestamp

Parameter DummyProgramFactory.updateProgramContract(address)._programContract (contracts/dummy/upgradeCheck/dummyProgramFactory.sol#36) is not in mixedCase
Parameter DummyProgramFactory.create(bytes,string)._encodedParameters (contracts/dummy/upgradeCheck/dummyProgramFactory.sol#48) is not in mixedCase
Parameter DummyProgramFactory.create(bytes,string)._foobar (contracts/dummy/upgradeCheck/dummyProgramFactory.sol#49) is not in mixedCase
Parameter DummyProgramImplementation.initialize(bytes,string)._encodedParameters (contracts/dummy/upgradeCheck/dummyProgramImplementation.sol#49) is not in mixedCase
Parameter DummyProgramImplementation.initialize(bytes,string)._foobar (contracts/dummy/upgradeCheck/dummyProgramImplementation.sol#50) is not in mixedCase
Parameter DummyProgramImplementation.updateMetaPtr(MetaPtr)._newMetaPtr (contracts/dummy/upgradeCheck/dummyProgramImplementation.sol#84) is not in mixedCase
Parameter DummyRoundFactory.updateRoundContract(address)._RoundContract (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#53) is not in mixedCase
Parameter DummyRoundFactory.create(bytes,address,string)._encodedParameters (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#66) is not in mixedCase
Parameter DummyRoundFactory.create(bytes,address,string)._ownedBy (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#67) is not in mixedCase
Parameter DummyRoundFactory.create(bytes,address,string)._foobar (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#68) is not in mixedCase
Variable DummyRoundFactory.RoundContract (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#26) is not in mixedCase
Parameter DummyRoundImplementation.initialize(bytes,string)._encodedParameters (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#108) is not in mixedCase
Parameter DummyRoundImplementation.initialize(bytes,string)._foobar (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#109) is not in mixedCase
Parameter DummyRoundImplementation.updateRoundMetaPtr(MetaPtr)._newRoundMetaPtr (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#177) is not in mixedCase
Parameter DummyRoundImplementation.updateApplicationMetaPtr(MetaPtr)._newApplicationMetaPtr (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#186) is not in mixedCase
Parameter DummyRoundImplementation.updateRoundStartTime(uint256)._newRoundStartTime (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#195) is not in mixedCase
Parameter DummyRoundImplementation.updateRoundEndTime(uint256)._newRoundEndTime (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#208) is not in mixedCase
Parameter DummyRoundImplementation.updateApplicationsStartTime(uint256)._newApplicationsStartTime (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#221) is not in mixedCase
Parameter DummyRoundImplementation.updateApplicationsEndTime(uint256)._newApplicationsEndTime (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#234) is not in mixedCase
Parameter DummyRoundImplementation.updateProjectsMetaPtr(MetaPtr)._newProjectsMetaPtr (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#247) is not in mixedCase
Parameter DummyRoundImplementation.applyToRound(address,MetaPtr)._project (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#257) is not in mixedCase
Parameter DummyRoundImplementation.applyToRound(address,MetaPtr)._applicationMetaPtr (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#257) is not in mixedCase
Parameter DummyRoundImplementation.vote(bytes[])._encodedVotes (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#263) is not in mixedCase
Parameter ProgramFactory.updateProgramContract(address)._programContract (contracts/program/ProgramFactory.sol#37) is not in mixedCase
Parameter ProgramFactory.create(bytes)._encodedParameters (contracts/program/ProgramFactory.sol#49) is not in mixedCase
Parameter ProgramImplementation.initialize(bytes)._encodedParameters (contracts/program/ProgramImplementation.sol#47) is not in mixedCase
Parameter ProgramImplementation.updateMetaPtr(MetaPtr)._newMetaPtr (contracts/program/ProgramImplementation.sol#79) is not in mixedCase
Parameter RoundFactory.updateRoundContract(address)._RoundContract (contracts/round/RoundFactory.sol#50) is not in mixedCase
Parameter RoundFactory.create(bytes,address)._encodedParameters (contracts/round/RoundFactory.sol#63) is not in mixedCase
Parameter RoundFactory.create(bytes,address)._ownedBy (contracts/round/RoundFactory.sol#64) is not in mixedCase
Variable RoundFactory.RoundContract (contracts/round/RoundFactory.sol#25) is not in mixedCase
Parameter RoundImplementation.initialize(bytes)._encodedParameters (contracts/round/RoundImplementation.sol#105) is not in mixedCase
Parameter RoundImplementation.updateRoundMetaPtr(MetaPtr)._newRoundMetaPtr (contracts/round/RoundImplementation.sol#171) is not in mixedCase
Parameter RoundImplementation.updateApplicationMetaPtr(MetaPtr)._newApplicationMetaPtr (contracts/round/RoundImplementation.sol#180) is not in mixedCase
Parameter RoundImplementation.updateRoundStartTime(uint256)._newRoundStartTime (contracts/round/RoundImplementation.sol#189) is not in mixedCase
Parameter RoundImplementation.updateRoundEndTime(uint256)._newRoundEndTime (contracts/round/RoundImplementation.sol#202) is not in mixedCase
Parameter RoundImplementation.updateApplicationsStartTime(uint256)._newApplicationsStartTime (contracts/round/RoundImplementation.sol#215) is not in mixedCase
Parameter RoundImplementation.updateApplicationsEndTime(uint256)._newApplicationsEndTime (contracts/round/RoundImplementation.sol#228) is not in mixedCase
Parameter RoundImplementation.updateProjectsMetaPtr(MetaPtr)._newProjectsMetaPtr (contracts/round/RoundImplementation.sol#241) is not in mixedCase
Parameter RoundImplementation.applyToRound(bytes32,MetaPtr)._projectID (contracts/round/RoundImplementation.sol#251) is not in mixedCase
Parameter RoundImplementation.applyToRound(bytes32,MetaPtr)._applicationMetaPtr (contracts/round/RoundImplementation.sol#251) is not in mixedCase
Parameter RoundImplementation.vote(bytes[])._encodedVotes (contracts/round/RoundImplementation.sol#257) is not in mixedCase
Parameter BulkVotingStrategy.vote(bytes[],address)._encodedVotes (contracts/votingStrategy/BulkVotingStrategy.sol#40) is not in mixedCase
Parameter BulkVotingStrategy.vote(bytes[],address)._voterAddress (contracts/votingStrategy/BulkVotingStrategy.sol#40) is not in mixedCase
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#conformance-to-solidity-naming-conventions

initialize() should be declared external:
	- DummyProgramFactory.initialize() (contracts/dummy/upgradeCheck/dummyProgramFactory.sol#23-26)
updateProgramContract(address) should be declared external:
	- DummyProgramFactory.updateProgramContract(address) (contracts/dummy/upgradeCheck/dummyProgramFactory.sol#36-40)
initialize(bytes,string) should be declared external:
	- DummyProgramImplementation.initialize(bytes,string) (contracts/dummy/upgradeCheck/dummyProgramImplementation.sol#48-80)
updateMetaPtr(MetaPtr) should be declared external:
	- DummyProgramImplementation.updateMetaPtr(MetaPtr) (contracts/dummy/upgradeCheck/dummyProgramImplementation.sol#84-87)
initialize() should be declared external:
	- DummyRoundFactory.initialize() (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#40-43)
updateRoundContract(address) should be declared external:
	- DummyRoundFactory.updateRoundContract(address) (contracts/dummy/upgradeCheck/dummyRoundFactory.sol#53-57)
initialize(bytes,string) should be declared external:
	- DummyRoundImplementation.initialize(bytes,string) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#107-173)
updateRoundMetaPtr(MetaPtr) should be declared external:
	- DummyRoundImplementation.updateRoundMetaPtr(MetaPtr) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#177-182)
updateApplicationMetaPtr(MetaPtr) should be declared external:
	- DummyRoundImplementation.updateApplicationMetaPtr(MetaPtr) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#186-191)
updateRoundStartTime(uint256) should be declared external:
	- DummyRoundImplementation.updateRoundStartTime(uint256) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#195-204)
updateRoundEndTime(uint256) should be declared external:
	- DummyRoundImplementation.updateRoundEndTime(uint256) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#208-217)
updateApplicationsStartTime(uint256) should be declared external:
	- DummyRoundImplementation.updateApplicationsStartTime(uint256) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#221-230)
updateApplicationsEndTime(uint256) should be declared external:
	- DummyRoundImplementation.updateApplicationsEndTime(uint256) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#234-243)
updateProjectsMetaPtr(MetaPtr) should be declared external:
	- DummyRoundImplementation.updateProjectsMetaPtr(MetaPtr) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#247-252)
applyToRound(address,MetaPtr) should be declared external:
	- DummyRoundImplementation.applyToRound(address,MetaPtr) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#257-259)
vote(bytes[]) should be declared external:
	- DummyRoundImplementation.vote(bytes[]) (contracts/dummy/upgradeCheck/dummyRoundImplementation.sol#263-266)
initialize() should be declared external:
	- ProgramFactory.initialize() (contracts/program/ProgramFactory.sol#24-27)
updateProgramContract(address) should be declared external:
	- ProgramFactory.updateProgramContract(address) (contracts/program/ProgramFactory.sol#37-41)
initialize(bytes) should be declared external:
	- ProgramImplementation.initialize(bytes) (contracts/program/ProgramImplementation.sol#46-75)
updateMetaPtr(MetaPtr) should be declared external:
	- ProgramImplementation.updateMetaPtr(MetaPtr) (contracts/program/ProgramImplementation.sol#79-82)
initialize() should be declared external:
	- RoundFactory.initialize() (contracts/round/RoundFactory.sol#37-40)
updateRoundContract(address) should be declared external:
	- RoundFactory.updateRoundContract(address) (contracts/round/RoundFactory.sol#50-54)
initialize(bytes) should be declared external:
	- RoundImplementation.initialize(bytes) (contracts/round/RoundImplementation.sol#104-167)
updateRoundMetaPtr(MetaPtr) should be declared external:
	- RoundImplementation.updateRoundMetaPtr(MetaPtr) (contracts/round/RoundImplementation.sol#171-176)
updateApplicationMetaPtr(MetaPtr) should be declared external:
	- RoundImplementation.updateApplicationMetaPtr(MetaPtr) (contracts/round/RoundImplementation.sol#180-185)
updateRoundStartTime(uint256) should be declared external:
	- RoundImplementation.updateRoundStartTime(uint256) (contracts/round/RoundImplementation.sol#189-198)
updateRoundEndTime(uint256) should be declared external:
	- RoundImplementation.updateRoundEndTime(uint256) (contracts/round/RoundImplementation.sol#202-211)
updateApplicationsStartTime(uint256) should be declared external:
	- RoundImplementation.updateApplicationsStartTime(uint256) (contracts/round/RoundImplementation.sol#215-224)
updateApplicationsEndTime(uint256) should be declared external:
	- RoundImplementation.updateApplicationsEndTime(uint256) (contracts/round/RoundImplementation.sol#228-237)
updateProjectsMetaPtr(MetaPtr) should be declared external:
	- RoundImplementation.updateProjectsMetaPtr(MetaPtr) (contracts/round/RoundImplementation.sol#241-246)
applyToRound(bytes32,MetaPtr) should be declared external:
	- RoundImplementation.applyToRound(bytes32,MetaPtr) (contracts/round/RoundImplementation.sol#251-253)
vote(bytes[]) should be declared external:
	- RoundImplementation.vote(bytes[]) (contracts/round/RoundImplementation.sol#257-260)
Reference: https://github.com/crytic/slither/wiki/Detector-Documentation#public-function-that-could-be-declared-external
. analyzed (28 contracts with 77 detectors), 95 result(s) found

[nfrgosselin]

Thanks for this @QEDK — I want to create some tickets for this. How do you want to break this up? It's hard for me to parse

[QEDK]

My personal approach would be one PR with atomic commits for each kind of fix, probably a story worth 2 points (assuming proficient in contracts) just a bit of manual back-and-forth and awareness required to identify the issues and implement the fixes.

[nfrgosselin]

Okay great, thanks @QEDK. I just created an issue with those parameters and tagged you in it. #211

[thelostone-mc]

Marking this as resolved