Omniscia Stakewise Audit
Roles Manual Review Findings
Roles Manual Review Findings
ROL-01M: Event-Based Role Management
| Type | Severity | Location |
|---|---|---|
| Logical Fault | Minor | Roles.sol:L21-L69 |
Description:
The way roles are managed in the contract is purely ephemeral and does not rely on any contract-level storage.
Example:
contracts/Roles.sol
21/**22 * @dev See {IRoles-setOperator}.23 */24function setOperator(address account, uint256 revenueShare) external override onlyAdmin whenNotPaused {25 require(account != address(0), "Roles: account is the zero address");26 require(revenueShare <= 1e4, "Roles: invalid revenue share");27 emit OperatorUpdated(account, revenueShare);28}29
30/**31 * @dev See {IRoles-removeOperator}.32 */33function removeOperator(address account) external override onlyAdmin whenNotPaused {34 require(account != address(0), "Roles: account is the zero address");35 emit OperatorRemoved(account);36}37
38/**39 * @dev See {IRoles-setPartner}.40 */41function setPartner(address account, uint256 revenueShare) external override onlyAdmin whenNotPaused {42 require(account != address(0), "Roles: account is the zero address");43 require(revenueShare <= 1e4, "Roles: invalid revenue share");44 emit PartnerUpdated(account, revenueShare);45}46
47/**48 * @dev See {IRoles-removePartner}.49 */50function removePartner(address account) external override onlyAdmin whenNotPaused {51 require(account != address(0), "Roles: account is the zero address");52 emit PartnerRemoved(account);53}54
55/**56 * @dev See {IRoles-addReferrer}.57 */58function addReferrer(address account) external override onlyAdmin whenNotPaused {59 require(account != address(0), "Roles: account is the zero address");60 emit ReferrerAdded(account);61}62
63/**64 * @dev See {IRoles-removeReferrer}.65 */66function removeReferrer(address account) external override onlyAdmin whenNotPaused {67 require(account != address(0), "Roles: account is the zero address");68 emit ReferrerRemoved(account);69}Recommendation:
While gas efficient, this methodology is primarily prone to block re-organizations at the blockchain level which can cause the off-chain accounting system to break. Secondarily, the Ethereum community advises against using events as a permanent data source as it may change with future EIPs. This concern, however, is minimal given that on such a principle production applications have been built such as Optimism.
Alleviation:
The Stakewise team considered this exhibit but opted to retain the current implementation in place.