LockScheme Manual Review Findings

LSE-01M: Unsanitized LockScheme Configuration

Description:

The constructor of the LockScheme configuration does not perform any validation on the input parameters.

Example:

Copy
42constructor(
43    uint256 _lockPeriod,
44    uint256 _rampUpPeriod,
45    uint256 _bonusPercent,
46    address _lmcContract
47) public {
48    lockPeriod = _lockPeriod;
49    rampUpPeriod = _rampUpPeriod;
50    bonusPercent = _bonusPercent;
51    lmcContract = _lmcContract;
52}

Recommendation:

Appropriate require checks should be imposed to ensure that the _lmcContract is not equal to the zero address (statically detected) as well as that the _lockPeriod is greater than or equal to the _rampUpPeriod given how these variables are meant to be utilized.

Alleviation:

Sanitization was introduced that ensures the _lmcContract is not zero and that the _rampUpPeriod is at least less than or equal to _lockPeriod thus ensuring that the configuration of the LockScheme will always be valid.