QA Report

[code423n4]

1. The getTokenPrice() function should revert instead of allowing a return value of 0 to avoid erroneous pricing issues.
2. A time-based check should be enforced in getPriceFromDex() to ensure that a stale value is not used.
3. setRouterRecipient() specifies that the router should only be able to set the value once in the dev comment; however, no validation to do so was enforced. Either validation should be added to only allow for the value to be set once or the comment should be clarified that it's a suggestion.
4. The Solidity version of 0.8.14 should be bumped up to 0.8.15. Note: I did not review whether the code was specifically affected by the bug. The Solidity version was vulnerable, an optimizer appeared to be used in the hardhat config, and inline assembly was used throughout the codebase - so the conditions were all met. As a result, the code in-scope may be vulnerable to the Solidity bug. Resolving the potential issue is straightforward as the upgrade is non-breaking.

[jakekidd]

1 and 2 are level 2 issues and duplicates of various other level 2s that have been addressed

3 is valid qa issue

4 is resolved