QA Report

[code423n4]

1. unused local variable
   PortalFacet.repayAavePortal() - adopted variable in https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/facets/PortalFacet.sol#L98

2. Unused function parameter
   PortalFacet.repayAavePortalFor() - _router param in https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/facets/PortalFacet.sol#L`26

3. dev notes documents that The router must be approved for portal and with enough liquidity, and must be the caller of this function.However a require check is missing to ensure msg.sender is the router - https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/facets/PortalFacet.sol#L80

4. _local variable used instead of adopted for _backloan() call in https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/facets/PortalFacet.sol#L112

5. SponsorVault.sol contract deployment could revert due to missing zero address check
   The construction function in SponsorVault.sol calls _setConnext() during deployment. If the _connext address is mistakenly inputed as 0, then the deployment of the contract will revert as seen in the require check in _setConnext()

6. Missing zero value check
   SponsorVault.setRate() - missing zero value check for _rate param - https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/facets/PortalFacet.sol#L80

7. Missing zero address check
   SponsorVault.setGasTokenOracle() - https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/helpers/SponsorVault.sol#L168

RelayerFacet.addRelayer() - https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/facets/RelayerFacet.sol#L101

8. Unused parameter
   BridgeFacet.handle() - _nonce param in https://github.com/code-423n4/2022-06-connext/blob/main/contracts/contracts/core/connext/facets/BridgeFacet.sol#L391

[jakekidd]

8 is invalid, it is an interface implementation, unused parameter is required

5+6+7 should be one issue

4 is level 2: Med Risk issue! a good spot (something we also spotted/have resolved since)

[0xleastwood]

no. 4 is a duplicate of #103, a more severe issue, but I won't upgrade it because the impact is not detailed in any way.

[0xleastwood]

Although, I'll give you kudos for some of these findings. great work!