Omniscia Stakewise Audit

Roles Manual Review Findings

Roles Manual Review Findings

ROL-01M: Event-Based Role Management

TypeSeverityLocation
Logical FaultMinorRoles.sol:L21-L69

Description:

The way roles are managed in the contract is purely ephemeral and does not rely on any contract-level storage.

Example:

contracts/Roles.sol
21/**
22 * @dev See {IRoles-setOperator}.
23 */
24function setOperator(address account, uint256 revenueShare) external override onlyAdmin whenNotPaused {
25 require(account != address(0), "Roles: account is the zero address");
26 require(revenueShare <= 1e4, "Roles: invalid revenue share");
27 emit OperatorUpdated(account, revenueShare);
28}
29
30/**
31 * @dev See {IRoles-removeOperator}.
32 */
33function removeOperator(address account) external override onlyAdmin whenNotPaused {
34 require(account != address(0), "Roles: account is the zero address");
35 emit OperatorRemoved(account);
36}
37
38/**
39 * @dev See {IRoles-setPartner}.
40 */
41function setPartner(address account, uint256 revenueShare) external override onlyAdmin whenNotPaused {
42 require(account != address(0), "Roles: account is the zero address");
43 require(revenueShare <= 1e4, "Roles: invalid revenue share");
44 emit PartnerUpdated(account, revenueShare);
45}
46
47/**
48 * @dev See {IRoles-removePartner}.
49 */
50function removePartner(address account) external override onlyAdmin whenNotPaused {
51 require(account != address(0), "Roles: account is the zero address");
52 emit PartnerRemoved(account);
53}
54
55/**
56 * @dev See {IRoles-addReferrer}.
57 */
58function addReferrer(address account) external override onlyAdmin whenNotPaused {
59 require(account != address(0), "Roles: account is the zero address");
60 emit ReferrerAdded(account);
61}
62
63/**
64 * @dev See {IRoles-removeReferrer}.
65 */
66function removeReferrer(address account) external override onlyAdmin whenNotPaused {
67 require(account != address(0), "Roles: account is the zero address");
68 emit ReferrerRemoved(account);
69}

Recommendation:

While gas efficient, this methodology is primarily prone to block re-organizations at the blockchain level which can cause the off-chain accounting system to break. Secondarily, the Ethereum community advises against using events as a permanent data source as it may change with future EIPs. This concern, however, is minimal given that on such a principle production applications have been built such as Optimism.

Alleviation:

The Stakewise team considered this exhibit but opted to retain the current implementation in place.