QA Report

[code423n4]

Here are QA reports per file.

---

CollateralAdapter.sol

[QA-1] address(0) checks are mising at addCollateralAsset function

addCollateralAsset function does not have any address(0) check.

https://github.com/code-423n4/2022-05-sturdy/blob/main/smart-contracts/CollateralAdapter.sol#L43-L46

function addCollateralAsset(
    address _externalAsset,
    address _internalAsset,
    address _acceptVault
) external onlyAdmin {
    _assetToVaults[_externalAsset] = _acceptVault;
    _collateralAssets[_externalAsset] = _internalAsset;
}

addCollateralAsset function is callable only by admin, but setting proper address(0) checks would be useful.

---

LidoVault.sol

[QA-2] withdrawOnLiquidation function is missing

https://github.com/code-423n4/2022-05-sturdy/blob/main/smart-contracts/LidoVault.sol#L18

LidoVault.sol does not override the withdrawOnLiquidation function. If not having this functionality on LidoVault is expected, LidoVault.sol can implement the withdrawOnLiquidation function which only has revert() or other appropriate logic to specify that LidoVault does not have this functionality.

[HickupHH3]

both NC