QA Report

[code423n4]

Developer notes should be removed from production code

Comments in production code should not contain developer discussion or notes about known bugs or problems. These issues should be tracked elsewhere and resolved before being deployed.

Comments of this kind can also indicate potential avenues of attack for an adversary.

The following lines are affected:

2022-06-connext/contracts/contracts/core/connext/facets/BridgeFacet.sol:1027:    // TODO: Should we call approve(0) and approve(totalRepayAmount) instead? or with a try catch to not affect gas on all cases?
2022-06-connext/contracts/contracts/core/connext/facets/BridgeFacet.sol:492:      // TODO: do we want to store a mapping of custodied token balances here?
2022-06-connext/contracts/contracts/core/connext/facets/BridgeFacet.sol:579:      // TODO: do we need to keep this
2022-06-connext/contracts/contracts/core/connext/facets/BridgeFacet.sol:594:    // FIXME: routers can repay any-amount out-of-band using the `repayAavePortal` method
2022-06-connext/contracts/contracts/core/connext/helpers/Executor.sol:7:// TODO: see note in below file re: npm
2022-06-connext/contracts/contracts/core/connext/libraries/LibConnextStorage.sol:303:  // BridgeFacet (cont.) TODO: can we move this