config.json

{
    "client_name": "Halo DAO",
    "commit_hash": "1cff704a4065256f30bb50858626aa7ef5552268",
    "final_hash": "04f83da3ebe42a1df6692e1e3080fab9ed051920",
    "date": "June 2021",
    "date_interval": "June 28 to July 2, 2021",
    "issues": [
        {
            "active_lock_reason": null,
            "assignee": null,
            "assignees": [],
            "author_association": "CONTRIBUTOR",
            "body": "**Description**\r\n\r\nDuring the `RewardsManager` deploy a few storage variables are set.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/90dd3734a922bb9dcb80fffba34fe9db3065c4d0/code/contracts/RewardsManager.sol#L26-L37\r\n\r\nThe variable storing the address for the HaloHalo contract is received as `_haloHaloContract` in the arguments.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/90dd3734a922bb9dcb80fffba34fe9db3065c4d0/code/contracts/RewardsManager.sol#L29\r\n\r\nThe contract's address is stored in `haloHaloContract` \r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/90dd3734a922bb9dcb80fffba34fe9db3065c4d0/code/contracts/RewardsManager.sol#L34\r\n\r\nAnd it is also stored in a separate variable as the `HaloHalo` interface\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/90dd3734a922bb9dcb80fffba34fe9db3065c4d0/code/contracts/RewardsManager.sol#L35\r\n\r\nHowever, both of the values are identical in the contract's storage.\r\n\r\nConsider this simplified example\r\n\r\n```solidity\r\ninterface SomeContract {\r\n    function doSomething() external;\r\n}\r\n\r\ncontract Save {\r\n    SomeContract someContract;\r\n    address someContractAddress;\r\n    \r\n    constructor(address _someContractAddress) {\r\n        someContract = SomeContract(_someContractAddress);\r\n        someContractAddress = _someContractAddress;\r\n    }\r\n}\r\n```\r\n\r\nThe contract `Save` receives an argument on deploy and proceeds to save the address both as an address (as `someContractAddress`), but also as a `SomeContract` interface (as `someContract`).\r\n\r\nWe deployed this contract locally (on a [Ganache](https://www.trufflesuite.com/ganache) instance) and checked the both of the storage slots in the contract after a successful deploy.\r\n\r\nWe connected to the local instance with [Hitomi](https://github.com/cleanunicorn/hitomi) and we're dropped in a web3 enabled local console.\r\n\r\n```text\r\n$ hitomi http://localhost:8545\r\nStarting Hitomi v0.3.2.\r\n\r\nConnected to http://localhost:8545.\r\n\r\nNode version: EthereumJS TestRPC/v2.13.2/ethereum-js\r\nEnode path: None\r\nProtocol version: 99\r\nChain ID: 1337\r\nBlock number: 0\r\nMining: False (0 hash rate)\r\nSyncing: False\r\n```\r\n\r\nWe proceeded to check the first storage slot representing `SomeContract someContract;`\r\n\r\n```text\r\n>>> web3.eth.getStorageAt(\"0x6F3dC8C964d3F2ce4A1Ba8CD6Da6E7320A69CC6D\", 0)\r\nHexBytes('0x5b38da6a701c568545dcfcb03fcb875f56beddc4')\r\n```\r\n\r\nAnd the second storage slot representing `address someContractAddress;`\r\n\r\n```text\r\n>>> web3.eth.getStorageAt(\"0x6F3dC8C964d3F2ce4A1Ba8CD6Da6E7320A69CC6D\", 1)\r\nHexBytes('0x5b38da6a701c568545dcfcb03fcb875f56beddc4')\r\n```\r\n\r\nWe can see both values are identical. Solidity needs to cast an address as an interface to know which methods are available and how to use them. The generated assembly doesn't do anything specific to the initially provided address, this is just syntactic sugar.\r\n\r\nBecause both values are identical, we don't need to save both of them in separate storage slots, this makes the save (or update) and the read more expensive. Saving only one of them is better because, on read, it doesn't need to retrieve both of them and storage handing (reading and writing) is very expensive.\r\n\r\n**Recommendation**\r\n\r\nUse only one of the storage slots to save either the HaloHalo contract and cast when needed to either access the address or the interface.\r\n",
            "closed_at": "2021-07-02T11:57:16Z",
            "comments": 0,
            "comments_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/6/comments",
            "created_at": "2021-07-01T13:34:12Z",
            "events_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/6/events",
            "html_url": "https://github.com/monoceros-alpha/review-halodao-rewards-2021-06/issues/6",
            "id": 934852991,
            "labels": [
                {
                    "color": "FFCC00",
                    "default": false,
                    "description": null,
                    "id": 3123486139,
                    "name": "Minor",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MTM5",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Minor"
                },
                {
                    "color": "667788",
                    "default": false,
                    "description": null,
                    "id": 3123486056,
                    "name": "Report",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MDU2",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Report"
                }
            ],
            "labels_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/6/labels{/name}",
            "locked": false,
            "milestone": null,
            "node_id": "MDU6SXNzdWU5MzQ4NTI5OTE=",
            "number": 6,
            "performed_via_github_app": null,
            "repository_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06",
            "state": "closed",
            "title": "Simplify storage of `haloHaloContract` in `RewardsManager`",
            "updated_at": "2021-07-02T11:57:16Z",
            "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/6",
            "user": {
                "avatar_url": "https://avatars.githubusercontent.com/u/547012?v=4",
                "events_url": "https://api.github.com/users/cleanunicorn/events{/privacy}",
                "followers_url": "https://api.github.com/users/cleanunicorn/followers",
                "following_url": "https://api.github.com/users/cleanunicorn/following{/other_user}",
                "gists_url": "https://api.github.com/users/cleanunicorn/gists{/gist_id}",
                "gravatar_id": "",
                "html_url": "https://github.com/cleanunicorn",
                "id": 547012,
                "login": "cleanunicorn",
                "node_id": "MDQ6VXNlcjU0NzAxMg==",
                "organizations_url": "https://api.github.com/users/cleanunicorn/orgs",
                "received_events_url": "https://api.github.com/users/cleanunicorn/received_events",
                "repos_url": "https://api.github.com/users/cleanunicorn/repos",
                "site_admin": false,
                "starred_url": "https://api.github.com/users/cleanunicorn/starred{/owner}{/repo}",
                "subscriptions_url": "https://api.github.com/users/cleanunicorn/subscriptions",
                "type": "User",
                "url": "https://api.github.com/users/cleanunicorn"
            }
        },
        {
            "active_lock_reason": null,
            "assignee": null,
            "assignees": [],
            "author_association": "CONTRIBUTOR",
            "body": "**Description**\r\n\r\nAn owner can add a new LP token to the list by calling `add`.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/4757f51facd18a0fa205ffd9961df8c6b0409deb/code/contracts/AmmRewards.sol#L85\r\n\r\nThere's a comment stating that rewards will suffer if the same LP token is added multiple times in the list.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/4757f51facd18a0fa205ffd9961df8c6b0409deb/code/contracts/AmmRewards.sol#L81\r\n\r\nConsider checking for duplicate tokens when adding a new one to make sure the system does not behave incorrectly.\r\n\r\n**Recommendation**\r\n\r\nIf the number of tokens will not be over 10, consider looping over the existing tokens, making sure the new token does not match one of the existing ones.\r\n\r\n```solidity\r\ncontract CheckWithLoop {\r\n    uint[] list;\r\n\r\n    function addLoop(uint n) public {\r\n        uint listLength = list.length;\r\n        for (uint i; i < listLength; i++) {\r\n            require(list[i] != n, \"no duplicates\");\r\n        }\r\n        list.push(n);\r\n    }\r\n}\r\n```\r\n\r\nIf you expect to have more than 10 tokens on the list, a mapping can be used to check the existence of a token.\r\n\r\n```solidity\r\ncontract CheckWithMapping {\r\n    uint[] list;\r\n    mapping(uint => bool) listDups;\r\n    \r\n    function addNonDuplicate(uint n) public {\r\n        require(listDups[n] == false, \"no duplicates\");\r\n        list.push(n);\r\n        listDups[n] = true;\r\n    }\r\n}\r\n```\r\n\r\n",
            "closed_at": "2021-07-02T13:23:46Z",
            "comments": 0,
            "comments_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/5/comments",
            "created_at": "2021-06-29T13:03:15Z",
            "events_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/5/events",
            "html_url": "https://github.com/monoceros-alpha/review-halodao-rewards-2021-06/issues/5",
            "id": 932639072,
            "labels": [
                {
                    "color": "FF9500",
                    "default": false,
                    "description": null,
                    "id": 3123486140,
                    "name": "Medium",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MTQw",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Medium"
                },
                {
                    "color": "667788",
                    "default": false,
                    "description": null,
                    "id": 3123486056,
                    "name": "Report",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MDU2",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Report"
                }
            ],
            "labels_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/5/labels{/name}",
            "locked": false,
            "milestone": null,
            "node_id": "MDU6SXNzdWU5MzI2MzkwNzI=",
            "number": 5,
            "performed_via_github_app": null,
            "repository_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06",
            "state": "closed",
            "title": "Consider checking for duplicate LP tokens when adding a new one in `AmmRewards`",
            "updated_at": "2021-07-02T13:23:46Z",
            "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/5",
            "user": {
                "avatar_url": "https://avatars.githubusercontent.com/u/547012?v=4",
                "events_url": "https://api.github.com/users/cleanunicorn/events{/privacy}",
                "followers_url": "https://api.github.com/users/cleanunicorn/followers",
                "following_url": "https://api.github.com/users/cleanunicorn/following{/other_user}",
                "gists_url": "https://api.github.com/users/cleanunicorn/gists{/gist_id}",
                "gravatar_id": "",
                "html_url": "https://github.com/cleanunicorn",
                "id": 547012,
                "login": "cleanunicorn",
                "node_id": "MDQ6VXNlcjU0NzAxMg==",
                "organizations_url": "https://api.github.com/users/cleanunicorn/orgs",
                "received_events_url": "https://api.github.com/users/cleanunicorn/received_events",
                "repos_url": "https://api.github.com/users/cleanunicorn/repos",
                "site_admin": false,
                "starred_url": "https://api.github.com/users/cleanunicorn/starred{/owner}{/repo}",
                "subscriptions_url": "https://api.github.com/users/cleanunicorn/subscriptions",
                "type": "User",
                "url": "https://api.github.com/users/cleanunicorn"
            }
        },
        {
            "active_lock_reason": null,
            "assignee": null,
            "assignees": [],
            "author_association": "CONTRIBUTOR",
            "body": "**Description**\r\n\r\nWhen the HaloToken is deployed, there are 2 state variables set:\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/4757f51facd18a0fa205ffd9961df8c6b0409deb/code/contracts/HaloToken.sol#L24-L25\r\n\r\nThe `canMint` state variable is checked when the owner tries to mint additional tokens.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/4757f51facd18a0fa205ffd9961df8c6b0409deb/code/contracts/HaloToken.sol#L40-L41\r\n\r\nThe owner can renounce this power by calling `setCapped`.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/4757f51facd18a0fa205ffd9961df8c6b0409deb/code/contracts/HaloToken.sol#L28-L30\r\n\r\nWhen `setCapped` is called, the state variable `isCappedFuncLocked` is checked to be false.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/4757f51facd18a0fa205ffd9961df8c6b0409deb/code/contracts/HaloToken.sol#L31\r\n\r\nOnce the check passes, `canMint` is set to `false`, blocking future token minting.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/4757f51facd18a0fa205ffd9961df8c6b0409deb/code/contracts/HaloToken.sol#L32\r\n\r\nAnd `isCappedFuncLocked` is set to `true`; this prevents a second call to `setCapped`.\r\n\r\nHowever, the 2 state variables are always synchronized. They can have the value `true` or `false`. And they only exist in these 2 states:\r\n\r\n1. Can mint tokens; can disable token minting\r\n```\r\ncanMint = true\r\nisCappedFuncLocked = false\r\n```\r\n\r\n2. Cannot mint tokens anymore; cannot re-enable token minting\r\n```\r\ncanMint = false\r\nisCappedFuncLocked = true\r\n```\r\n\r\nThe code can be simplified if one of the 2 state variables is removed, the other one's value can be deduced by negating the remaining one.\r\n\r\n**Recommendation**\r\n\r\nRemove `isCappedFuncLocked` and use `canMint` to limit the `setCapped` execution.\r\n",
            "closed_at": "2021-07-02T11:53:21Z",
            "comments": 0,
            "comments_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/4/comments",
            "created_at": "2021-06-29T10:55:44Z",
            "events_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/4/events",
            "html_url": "https://github.com/monoceros-alpha/review-halodao-rewards-2021-06/issues/4",
            "id": 932492099,
            "labels": [
                {
                    "color": "FFCC00",
                    "default": false,
                    "description": null,
                    "id": 3123486139,
                    "name": "Minor",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MTM5",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Minor"
                },
                {
                    "color": "667788",
                    "default": false,
                    "description": null,
                    "id": 3123486056,
                    "name": "Report",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MDU2",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Report"
                }
            ],
            "labels_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/4/labels{/name}",
            "locked": false,
            "milestone": null,
            "node_id": "MDU6SXNzdWU5MzI0OTIwOTk=",
            "number": 4,
            "performed_via_github_app": null,
            "repository_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06",
            "state": "closed",
            "title": "Capping the minting process can be simplified",
            "updated_at": "2021-07-02T11:53:21Z",
            "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/4",
            "user": {
                "avatar_url": "https://avatars.githubusercontent.com/u/547012?v=4",
                "events_url": "https://api.github.com/users/cleanunicorn/events{/privacy}",
                "followers_url": "https://api.github.com/users/cleanunicorn/followers",
                "following_url": "https://api.github.com/users/cleanunicorn/following{/other_user}",
                "gists_url": "https://api.github.com/users/cleanunicorn/gists{/gist_id}",
                "gravatar_id": "",
                "html_url": "https://github.com/cleanunicorn",
                "id": 547012,
                "login": "cleanunicorn",
                "node_id": "MDQ6VXNlcjU0NzAxMg==",
                "organizations_url": "https://api.github.com/users/cleanunicorn/orgs",
                "received_events_url": "https://api.github.com/users/cleanunicorn/received_events",
                "repos_url": "https://api.github.com/users/cleanunicorn/repos",
                "site_admin": false,
                "starred_url": "https://api.github.com/users/cleanunicorn/starred{/owner}{/repo}",
                "subscriptions_url": "https://api.github.com/users/cleanunicorn/subscriptions",
                "type": "User",
                "url": "https://api.github.com/users/cleanunicorn"
            }
        },
        {
            "active_lock_reason": null,
            "assignee": null,
            "assignees": [],
            "author_association": "CONTRIBUTOR",
            "body": "**Description**\r\n\r\nWhen a user wants to unstake their tokens, they need to call `leave`.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/625eb4d3d0f780cfe06bb3f44ccbbea37149bd8b/code/contracts/HaloHalo.sol#L44-L46\r\n\r\nThe amount of tokens to be unlocked is calculated and saved in a local variable `haloHaloAmount`:\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/625eb4d3d0f780cfe06bb3f44ccbbea37149bd8b/code/contracts/HaloHalo.sol#L49-L51\r\n\r\nThis value should be named `haloAmount` because this value is then used to send the halo tokens back to the user.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/625eb4d3d0f780cfe06bb3f44ccbbea37149bd8b/code/contracts/HaloHalo.sol#L53\r\n\r\n**Recommendation**\r\n\r\nRename the variable `haloHaloAmount` to `haloAmount`.\r\n",
            "closed_at": "2021-07-02T11:51:33Z",
            "comments": 0,
            "comments_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/3/comments",
            "created_at": "2021-06-29T09:18:16Z",
            "events_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/3/events",
            "html_url": "https://github.com/monoceros-alpha/review-halodao-rewards-2021-06/issues/3",
            "id": 932407253,
            "labels": [
                {
                    "color": "FFCC00",
                    "default": false,
                    "description": null,
                    "id": 3123486139,
                    "name": "Minor",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MTM5",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Minor"
                },
                {
                    "color": "667788",
                    "default": false,
                    "description": null,
                    "id": 3123486056,
                    "name": "Report",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MDU2",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Report"
                }
            ],
            "labels_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/3/labels{/name}",
            "locked": false,
            "milestone": null,
            "node_id": "MDU6SXNzdWU5MzI0MDcyNTM=",
            "number": 3,
            "performed_via_github_app": null,
            "repository_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06",
            "state": "closed",
            "title": "`haloHaloAmount` should be renamed to `haloAmount`",
            "updated_at": "2021-07-02T11:51:33Z",
            "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/3",
            "user": {
                "avatar_url": "https://avatars.githubusercontent.com/u/547012?v=4",
                "events_url": "https://api.github.com/users/cleanunicorn/events{/privacy}",
                "followers_url": "https://api.github.com/users/cleanunicorn/followers",
                "following_url": "https://api.github.com/users/cleanunicorn/following{/other_user}",
                "gists_url": "https://api.github.com/users/cleanunicorn/gists{/gist_id}",
                "gravatar_id": "",
                "html_url": "https://github.com/cleanunicorn",
                "id": 547012,
                "login": "cleanunicorn",
                "node_id": "MDQ6VXNlcjU0NzAxMg==",
                "organizations_url": "https://api.github.com/users/cleanunicorn/orgs",
                "received_events_url": "https://api.github.com/users/cleanunicorn/received_events",
                "repos_url": "https://api.github.com/users/cleanunicorn/repos",
                "site_admin": false,
                "starred_url": "https://api.github.com/users/cleanunicorn/starred{/owner}{/repo}",
                "subscriptions_url": "https://api.github.com/users/cleanunicorn/subscriptions",
                "type": "User",
                "url": "https://api.github.com/users/cleanunicorn"
            }
        },
        {
            "active_lock_reason": null,
            "assignee": null,
            "assignees": [],
            "author_association": "CONTRIBUTOR",
            "body": "**Description**\r\n\r\nA user can stake HALO tokens for HALOHALO tokens by calling the `enter` method.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/625eb4d3d0f780cfe06bb3f44ccbbea37149bd8b/code/contracts/HaloHalo.sol#L23\r\n\r\nThe number of HALO tokens is retrieved:\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/625eb4d3d0f780cfe06bb3f44ccbbea37149bd8b/code/contracts/HaloHalo.sol#L27-L28\r\n\r\nNext, the total number of shares is retrieved, which matches the number of minted tokens:\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/625eb4d3d0f780cfe06bb3f44ccbbea37149bd8b/code/contracts/HaloHalo.sol#L29-L30\r\n\r\nIf this is the first time someone enters the stake, the conditional is true, and a ratio of 1:1 is minted based on the amount entering the contract.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/625eb4d3d0f780cfe06bb3f44ccbbea37149bd8b/code/contracts/HaloHalo.sol#L31-L33\r\n\r\ni.e., An actor entering with 100 HALO tokens will receive 100 HALOHALO tokens.\r\n\r\nIf tokens were already minted and HALO tokens exist in the contract, a formula is used to calculate how many tokens should be minted.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/625eb4d3d0f780cfe06bb3f44ccbbea37149bd8b/code/contracts/HaloHalo.sol#L35-L37\r\n\r\nLet's assume an actor is the first one to stake tokens in the contract. They send 100 HALO tokens to the contact. Because they are the first ones, the contract mints 1:1 tokens, effectively 100 HALOHALO tokens.\r\n\r\nThe second actor enters with 100 HALO too. This time, the formula is activated.\r\n\r\n$hh_{amount} = \\frac{h_{enter} * hh_{minted}}{h_{locked}}$\r\n\r\nA number of $hh_{amount} = 100$ get minted. \r\n\r\nThis is because the formula uses the amount of tokens which the user wants to lock ($h_{enter} = 100$), the number of tokens already minted ($hh_{minted} = 100$, from the previous user) and the total locked tokens in the contract ($h_{locked} = 100$).\r\n\r\nminted tokens = $\\frac{100 * 100}{100} = 100$\r\n\r\nIf everything works well, a ratio of 1:1 will always be respected. However, if anyone sends HALO tokens to the contract, the 1:1 ratio is forever changed for all users staking tokens.\r\n\r\nLet's assume that after the 2 users deposited 100 HALO tokens each, and they received 100 HALOHALO tokens, a malicious user sends 100 HALO tokens to the contract without calling `enter`, but by using the `transfer` method.\r\n\r\nWe should be aware of the current state of the contract right now.\r\n\r\n$hh_{minted} = 200$\r\n\r\n$h_{locked} = 300$\r\n\r\nThe number of $h_{locked}$ is equal to 300 because the actual balance of the token is retrieved by using the `balanceOf` method, not an internal accounting method.\r\n\r\nIf a 3rd user wants to lock 100 HALO tokens, a different ratio of HALOHALO tokens will be minted for them. Using the formula, we obtain the number of minted tokens.\r\n\r\nMinted tokens = $\\frac{100 * 200}{300} = 66.66$\r\n\r\nThis allows a malicious actor to manipulate the ratio of minted tokens.\r\n\r\nIt's important to note that the \"unstake\" mechanism is not affected negatively because the current ratio is used to return the tokens back to the users. Also, the actor who sends the tokens doesn't seem to gain anything from sending the tokens; in fact, they lose the tokens they sent to the contract, and the users being part of the system (who used `enter`) gain the lost tokens.\r\n\r\n\r\n\r\n\r\n\r\n",
            "closed_at": "2021-07-02T11:49:11Z",
            "comments": 0,
            "comments_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/2/comments",
            "created_at": "2021-06-28T14:25:45Z",
            "events_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/2/events",
            "html_url": "https://github.com/monoceros-alpha/review-halodao-rewards-2021-06/issues/2",
            "id": 931632555,
            "labels": [
                {
                    "color": "007AFF",
                    "default": false,
                    "description": null,
                    "id": 3123486214,
                    "name": "Acknowledged",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MjE0",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Acknowledged"
                },
                {
                    "color": "34C759",
                    "default": false,
                    "description": null,
                    "id": 3123486083,
                    "name": "Informational",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MDgz",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Informational"
                },
                {
                    "color": "667788",
                    "default": false,
                    "description": null,
                    "id": 3123486056,
                    "name": "Report",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MDU2",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Report"
                }
            ],
            "labels_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/2/labels{/name}",
            "locked": false,
            "milestone": null,
            "node_id": "MDU6SXNzdWU5MzE2MzI1NTU=",
            "number": 2,
            "performed_via_github_app": null,
            "repository_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06",
            "state": "closed",
            "title": "The number of minted tokens might not be the expected one",
            "updated_at": "2021-07-02T13:17:18Z",
            "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/2",
            "user": {
                "avatar_url": "https://avatars.githubusercontent.com/u/547012?v=4",
                "events_url": "https://api.github.com/users/cleanunicorn/events{/privacy}",
                "followers_url": "https://api.github.com/users/cleanunicorn/followers",
                "following_url": "https://api.github.com/users/cleanunicorn/following{/other_user}",
                "gists_url": "https://api.github.com/users/cleanunicorn/gists{/gist_id}",
                "gravatar_id": "",
                "html_url": "https://github.com/cleanunicorn",
                "id": 547012,
                "login": "cleanunicorn",
                "node_id": "MDQ6VXNlcjU0NzAxMg==",
                "organizations_url": "https://api.github.com/users/cleanunicorn/orgs",
                "received_events_url": "https://api.github.com/users/cleanunicorn/received_events",
                "repos_url": "https://api.github.com/users/cleanunicorn/repos",
                "site_admin": false,
                "starred_url": "https://api.github.com/users/cleanunicorn/starred{/owner}{/repo}",
                "subscriptions_url": "https://api.github.com/users/cleanunicorn/subscriptions",
                "type": "User",
                "url": "https://api.github.com/users/cleanunicorn"
            }
        },
        {
            "active_lock_reason": null,
            "assignee": null,
            "assignees": [],
            "author_association": "CONTRIBUTOR",
            "body": "**Description**\r\n\r\nThe Halo token contract is set when the `HaloHalo` contract is deployed.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/625eb4d3d0f780cfe06bb3f44ccbbea37149bd8b/code/contracts/HaloHalo.sol#L16\r\n\r\nThe `halo` variable is defined as a state variable.\r\n\r\nhttps://github.com/monoceros-alpha/review-halodao-rewards-2021-06/blob/625eb4d3d0f780cfe06bb3f44ccbbea37149bd8b/code/contracts/HaloHalo.sol#L10\r\n\r\nBecause this state variable is never changed, it can be defined as `immutable` for a significant gas cost.\r\n\r\n**Recommendation**\r\n\r\nSet `halo` as `immutable`.\r\n",
            "closed_at": "2021-07-02T11:48:41Z",
            "comments": 0,
            "comments_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/1/comments",
            "created_at": "2021-06-28T12:26:35Z",
            "events_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/1/events",
            "html_url": "https://github.com/monoceros-alpha/review-halodao-rewards-2021-06/issues/1",
            "id": 931517293,
            "labels": [
                {
                    "color": "FFCC00",
                    "default": false,
                    "description": null,
                    "id": 3123486139,
                    "name": "Minor",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MTM5",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Minor"
                },
                {
                    "color": "667788",
                    "default": false,
                    "description": null,
                    "id": 3123486056,
                    "name": "Report",
                    "node_id": "MDU6TGFiZWwzMTIzNDg2MDU2",
                    "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/labels/Report"
                }
            ],
            "labels_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/1/labels{/name}",
            "locked": false,
            "milestone": null,
            "node_id": "MDU6SXNzdWU5MzE1MTcyOTM=",
            "number": 1,
            "performed_via_github_app": null,
            "repository_url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06",
            "state": "closed",
            "title": "Can set immutable for `halo` in `HaloHalo`",
            "updated_at": "2021-07-02T11:48:41Z",
            "url": "https://api.github.com/repos/monoceros-alpha/review-halodao-rewards-2021-06/issues/1",
            "user": {
                "avatar_url": "https://avatars.githubusercontent.com/u/547012?v=4",
                "events_url": "https://api.github.com/users/cleanunicorn/events{/privacy}",
                "followers_url": "https://api.github.com/users/cleanunicorn/followers",
                "following_url": "https://api.github.com/users/cleanunicorn/following{/other_user}",
                "gists_url": "https://api.github.com/users/cleanunicorn/gists{/gist_id}",
                "gravatar_id": "",
                "html_url": "https://github.com/cleanunicorn",
                "id": 547012,
                "login": "cleanunicorn",
                "node_id": "MDQ6VXNlcjU0NzAxMg==",
                "organizations_url": "https://api.github.com/users/cleanunicorn/orgs",
                "received_events_url": "https://api.github.com/users/cleanunicorn/received_events",
                "repos_url": "https://api.github.com/users/cleanunicorn/repos",
                "site_admin": false,
                "starred_url": "https://api.github.com/users/cleanunicorn/starred{/owner}{/repo}",
                "subscriptions_url": "https://api.github.com/users/cleanunicorn/subscriptions",
                "type": "User",
                "url": "https://api.github.com/users/cleanunicorn"
            }
        }
    ],
    "person_days": "10",
    "project_name": "Halo Rewards",
    "review_period": "1 week",
    "source_repository": "https://github.com/HaloDAO/halo-rewards.git",
    "template": "./Readme.md.mustache"
}