QA Report

[code423n4]

1. Zero address check
   https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/peg/NonCustodialPSM.sol#L105
   https://github.com/code-423n4/2022-03-volt/blob/main/contracts/oracle/ScalingPriceOracle.sol#L88
2. Unhandled output
   https://github.com/code-423n4/2022-03-volt/blob/f1210bf3151095e4d371c9e9d7682d9031860bbd/contracts/pcv/compound/ERC20CompoundPCVDeposit.sol#L31
3. It's better to convert previousMonth to int256, it contains implicit conversion to int256 from int 128
   https://github.com/code-423n4/2022-03-volt/blob/main/contracts/oracle/ScalingPriceOracle.sol#L124
4. Misleading comment, it's time from initTimed not contract initialization
   https://github.com/code-423n4/2022-03-volt/blob/main/contracts/utils/Timed.sol#L49
5. Need to always check LINK balance of oracle, when balance < fee oracle can't make update CPI request
   https://github.com/code-423n4/2022-03-volt/blob/main/contracts/oracle/ScalingPriceOracle.sol#L150
6. If currentMonth in init is 0, then CPI update will revert, zero div
   https://github.com/code-423n4/2022-03-volt/blob/main/contracts/oracle/ScalingPriceOracle.sol#L92
   https://github.com/code-423n4/2022-03-volt/blob/main/contracts/oracle/ScalingPriceOracle.sol#L174
   https://github.com/code-423n4/2022-03-volt/blob/main/contracts/utils/Deviation.sol#L23

[CloudEllie]

Judge @jack-the-pug has assessed the sixth item here, "If currentMonth in init is 0, then CPI update will revert, zero div" as Medium risk, so I have created a separate issue for it: #128 . Also note that issue is a duplicate of issue #58 .