QA Report

[code423n4]

Invalid signer are also accepted

Contract:
Disputes

Issue:
In case signature provided is invalid, SignatureDecoder.recoverKey will return with 0 address. The function still process this 0 address and creates a new dispute with 0 address owner

Recommendation:
Kindly add below check:

function raiseDispute(bytes calldata _data, bytes calldata _signature)
        external
        override
        onlyProject
    {
        // Recover signer from signature
        address _signer = SignatureDecoder.recoverKey(
            keccak256(_data),
            _signature,
            0
        );
require(_signer != address(0), "Incorrect signature");
}

initialize can be called by any external user

Contract:
Disputes

Issue:
It seems that user can call the initialize function before owner has chance to do the same. This will initialize the homeFi variable incorrectly. Although this is not serious as Owner can immediately discard this contract but would be good to restrict this function

Recommendation:
Kindly allow only owner/deployer to call this function