QA Report

[code423n4]

[Low-01] Unlimited feeRate

Impact

In the setFee function, there is no restriction on feeRate

    function setFee(uint256 feeRate_) external onlyOwner {
        feeRate = feeRate_;
    }

Proof of Concept

https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L119-L121

Tools Used

None

Recommended Mitigation Steps

Require feeRate < 10 (or whatever) * 1e18 / 100

[Low-02] Missing event & timelock for critical onlyOwner functions

Impact

Same as code-423n4/2021-09-swivel-findings#101 and code-423n4/2021-11-overlay-findings#120

onlyOwner functions that change critical contract parameters/addresses/state should emit events and consider adding timelocks so that users and other privileged roles can detect upcoming changes (by offchain monitoring of events) and have the time to react to them.

Proof of Concept

https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L119-L121

    function setFee(uint256 feeRate_) external onlyOwner {
        feeRate = feeRate_;
    }

Tools Used

None

Recommended Mitigation Steps

Consider using a timelock for critical params of the system and emitting events to inform the outside world.

[Low-03] Incorrect require message

Impact

The require message below should be "Reserve strike too large"

        require(dutchAuctionReserveStrike < strikeOptions[dutchAuctionStartingStrikeIndex], "Reserve strike too small");

Proof of Concept

https://github.com/code-423n4/2022-05-cally/blob/1849f9ee12434038aa80753266ce6a2f2b082c59/contracts/src/Cally.sol#L169-L169

Tools Used

None

Recommended Mitigation Steps

        require(dutchAuctionReserveStrike < strikeOptions[dutchAuctionStartingStrikeIndex], "Reserve strike too large");

[outdoteth]

[Low-01] Unlimited feeRate and [Low-02] Missing event & timelock for critical onlyOwner functions can be bumped to medium severity:

owner can change fee at any time; #47
owner can set fee greater than 100%: #48

[HardlyDifficult]

Per the C4 guidance "part of auditing is demonstrating proper theory of how an issue could be exploited" -- so going to score this as a QA report.