| | Issue | Instances | |----|-------|:---------:| | [N-01] | `internal/private` Function calls within for loops | 4 | | [N-02] | Non-library/interface files should use fixed compiler versions, not floating ones | 1 | | [N-03] | Array indices should be referenced via `enum`s rather than via numeric literals | 1 | | [N-04] | Missing Event Emission After Critical Initialize() Function | 2 | | [N-05] | Mixed usage of `int/uint` with `int256/uint256` | 299 | | [N-06] | Variables need not be initialized to zero | 10 | | [N-07] | Multiple Interfaces in Single File | 7 | | [N-08] | Multiple `address`/ID mappings can be combined into a single `mapping` of an `address`/ID to a `struct`, for readability | 3 | | [N-09] | Consider returning a `struct` rather than having multiple `return` values | 4 | | [N-10] | Consider using a `struct` rather than having many function input parameters | 20 | | [N-11] | Simplify complex require statements | 6 | | [N-12] | Consider using descriptive `constant`s when passing zero as a function argument | 4 | | [N-13] | Avoid Empty Blocks in Code | 2 | | [N-14] | Interfaces and Contracts in the Same File | 13 | | [N-15] | Multiple Contracts Declared in Single File | 7 | | [N-16] | `uint/int` variables should have the bit size defined explicitly | 299 | | [N-17] | Consider using `delete` rather than assigning `false` to clear values | 4 | | [N-18] | Consider emitting an event at the end of the constructor | 6 | | [N-19] | Consider moving duplicated strings to constants | 8 | | [N-20] | Consider using named returns | 49 | | [N-21] | Expressions for constant values should use `immutable` rather than `constant` | 14 | | [N-22] | Consider using named function arguments | 28 | | [N-23] | For loops in public or external functions should be avoided due to high gas costs and possible `revert` | 14 | | [N-24] | Function Parameters in Public Accessible Functions Need `address(0)` Check | 29 | | [N-25] | Events are missing sender information | 42 | | [N-26] | Leverage Recent Solidity Features with `0.8.23` | 14 | | [N-27] | `pragma experimental ABIEncoderV2` is deprecated | 7 | | [N-28] | High cyclomatic complexity | 4 | | [N-29] | Contract should expose an `interface` | 48 | | [N-30] | Critical system parameter changes should be behind a timelock | 6 | | [N-31] | Outdated Solidity Version | 14 | | [N-32] | Ensure Non-Empty Check for Bytes in Function Parameters | 29 | | [N-33] | Assembly blocks should have extensive comments | 6 | | [N-34] | State-Altering Functions Should Emit Events | 2 | | [N-35] | Upgrade `openzeppelin` to the Latest Version - 5.0.0 | 4 | | [N-36] | Interface Names Should Begin with a Capital `I` | 7 | | [N-37] | Duplicated `require()`/`revert()` checks should be refactored to a modifier or function | 4 | | [N-38] | Non-specific Imports | 11 | | [N-39] | Event is not properly `indexed` | 46 | | [N-40] | Consider Adding Emergency-Stop Functionality | 11 | | [N-41] | `constant` variables not using all capital letters | 6 | | [N-42] | Not using the named return variables anywhere in the function is confusing | 4 | | [N-43] | Function Names Not in mixedCase | 16 | | [N-44] | Insufficient Comments in Complex Functions | 5 | | [N-45] | Common functions should be refactored to a common base contract | 80 | | [N-46] | `constant`s should be defined rather than using magic numbers | 10 | | [N-47] | Consider moving `msg.sender` checks to a common authorization `modifier` | 44 | | [N-48] | Style guide: Non-`external`/`public` function names should begin with an underscore | 19 | | [N-49] | Unused Function Parameters | 1 | | [N-50] | Consider defining system-wide constants in a single file | 12 | | [N-51] | Consider making contracts `Upgradeable` | 17 | | [N-52] | Events that mark critical parameter changes should contain both the old and the new value | 12 | | [N-53] | Style guide: Non-`external`/`public` variable names should begin with an underscore | 4 | | [N-54] | Style guide: Contract does not follow the Solidity style guide's suggested layout ordering | 9 | | [N-55] | Using Low-Level Call for Transfers | 1 | | [N-56] | Consider bounding input array length | 1 | | [N-57] | Constants in comparisons should appear on the left side | 24 | | [N-58] | Named Imports of Parent Contracts Are Missing | 2 | | [N-59] | Long functions should be refactored into multiple, smaller, functions | 5 | | [N-60] | `public` functions not called by the contract should be declared `external` instead | 43 | | [N-61] | Unused Event Declarations | 3 | | [N-62] | Non-assembly High-Level Solidity Functions Available | 4 | | [N-63] | `else`-block not required | 5 | | [N-64] | Style guide: Function ordering does not follow the Solidity style guide | 30 | | [N-65] | Style guide: Lines are too long | 45 | | [N-66] | Style guide: Extraneous whitespace | 12 | | [N-67] | Misplaced or Missing SPDX identifier | 8 | | [N-68] | Contract/Libraries Names Do Not Match Their Filenames | 3 | | [N-69] | Unused import | 4 | | [N-70] | `if`-statement can be converted to a ternary | 2 | | [N-71] | Setters should prevent re-setting of the same value | 15 | | [N-72] | Contracts should have full test coverage | 1 | | [N-73] | Large or complicated code bases should implement invariant tests | 1 | | [N-74] | Implement Formal Verification Proofs to Improve Security | 1 | ### [N-01] `internal/private` Function calls within for loops Making function calls or external calls within loops in Solidity can lead to inefficient gas usage, potential bottlenecks, and increased vulnerability to attacks. Each function call or external call consumes gas, and when executed within a loop, the gas cost multiplies, potentially causing the transaction to run out of gas or exceed block gas limits. This can result in transaction failure or unpredictable behavior.

4 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 220: _queueOrRevert(proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], eta) ``` [220](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L220) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 180: queueOrRevertInternal( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], eta ) ``` [180](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L180) ```solidity File: contracts/legacy/GovernorAlpha2.sol 221: _queueOrRevert(proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], eta) ``` [221](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L221) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 270: queueOrRevertInternal( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], eta, uint8(proposal.proposalType) ) ``` [270](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L270)

### [N-02] Non-library/interface files should use fixed compiler versions, not floating ones Floating pragmas may lead to unintended vulnerabilities due to different compiler versions. It is recommended to lock the Solidity version in pragma statements.

1 issue instances in 1 files:

```solidity File: contracts/Governance/Timelock.sol 1: pragma solidity ^0.5.16 ``` [1](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L1)

### [N-03] Array indices should be referenced via `enum`s rather than via numeric literals Using constant array indexes can make your Solidity code harder to read and maintain. To improve clarity, consider using commented enum values in place of constant array indexes. Enums provide a way to define a type that has a few pre-defined values, making your code more self-explanatory and easy to understand. This can be particularly helpful in large codebases or when working with a team.

1 issue instances in 1 files:

```solidity File: contracts/Governance/GovernorBravoDelegate.sol 117: proposalTimelocks[0] ``` [117](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L117)

### [N-04] Missing Event Emission After Critical Initialize() Function Emitting an initialization event offers clear, on-chain evidence of the contract's initialization state, enhancing transparency and auditability. This practice aids users and developers in accurately tracking the contract's lifecycle, pinpointing the precise moment of its initialization. Moreover, it aligns with best practices for event logging in smart contracts, ensuring that significant state changes are both observable and verifiable through emitted events.

2 issue instances in 2 files:

```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 51: function initialize( address timelock_, address xvsVault_, uint votingPeriod_, uint votingDelay_, uint proposalThreshold_, address guardian_ ) public ``` [51](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L51) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 111: function initialize( address xvsVault_, ProposalConfig[] memory proposalConfigs_, TimelockInterface[] memory timelocks, address guardian_ ) public ``` [111](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L111)

### [N-05] Mixed usage of `int/uint` with `int256/uint256` In Solidity, int256 and uint256 are the preferred type names, especially since they are used for function signatures. Using int or uint instead can lead to confusion and inconsistency. Suggest replacing them with int256 or uint256 respectively, for better clarity and uniformity in your codebase. Improving this aspect of your code can contribute to its readability, understandability, and thus maintainability in the long term.

299 issue instances in 8 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 9: function quorumVotes() public pure returns (uint) { 14: function proposalThreshold() public pure returns (uint) { 19: function proposalMaxOperations() public pure returns (uint) { 24: function votingDelay() public pure returns (uint) { 29: function votingPeriod() public pure returns (uint) { 43: uint public proposalCount; 47: uint id; 51: uint eta; 55: uint[] values; 61: uint startBlock; 63: uint endBlock; 65: uint forVotes; 67: uint againstVotes; 113: uint id, 116: uint[] values, 119: uint startBlock, 120: uint endBlock, 125: event VoteCast(address voter, uint proposalId, bool support, uint votes); 125: event VoteCast(address voter, uint proposalId, bool support, uint votes); 128: event ProposalCanceled(uint id); 131: event ProposalQueued(uint id, uint eta); 131: event ProposalQueued(uint id, uint eta); 134: event ProposalExecuted(uint id); 144: uint[] memory values, 148: ) public returns (uint) { 162: uint latestProposalId = latestProposalIds[msg.sender]; 175: uint startBlock = add256(block.number, votingDelay()); 176: uint endBlock = add256(startBlock, votingPeriod()); 212: function queue(uint proposalId) public { 218: uint eta = add256(block.timestamp, timelock.delay()); 219: for (uint i = 0; i < proposal.targets.length; i++) { 226: function _queueOrRevert(address target, uint value, string memory signature, bytes memory data, uint eta) internal { 226: function _queueOrRevert(address target, uint value, string memory signature, bytes memory data, uint eta) internal { 234: function execute(uint proposalId) public payable { 241: for (uint i = 0; i < proposal.targets.length; i++) { 253: function cancel(uint proposalId) public { 265: for (uint i = 0; i < proposal.targets.length; i++) { 279: uint proposalId 283: returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) 289: function getReceipt(uint proposalId, address voter) public view returns (Receipt memory) { 293: function state(uint proposalId) public view returns (ProposalState) { 315: function castVote(uint proposalId, bool support) public { 319: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public { 330: function _castVote(address voter, uint proposalId, bool support) internal { 360: function __queueSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { 365: function __executeSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { 370: function add256(uint256 a, uint256 b) internal pure returns (uint) { 371: uint c = a + b; 376: function sub256(uint256 a, uint256 b) internal pure returns (uint) { 381: function getChainId() internal pure returns (uint) { 382: uint chainId; 391: function delay() external view returns (uint); 393: function GRACE_PERIOD() external view returns (uint); 401: uint value, 404: uint eta 409: uint value, 412: uint eta 417: uint value, 420: uint eta 425: function getPriorVotes(address account, uint blockNumber) external view returns (uint96); ``` [9](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L9) | [14](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L14) | [19](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L19) | [24](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L24) | [29](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L29) | [43](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L43) | [47](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L47) | [51](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L51) | [55](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L55) | [61](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L61) | [63](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L63) | [65](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L65) | [67](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L67) | [113](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L113) | [116](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L116) | [119](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L119) | [120](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L120) | [125](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L125) | [125](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L125) | [128](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L128) | [131](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L131) | [131](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L131) | [134](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L134) | [144](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L144) | [148](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L148) | [162](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L162) | [175](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L175) | [176](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L176) | [212](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L212) | [218](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L218) | [219](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L219) | [226](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L226) | [226](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L226) | [234](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L234) | [241](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L241) | [253](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L253) | [265](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L265) | [279](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L279) | [283](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L283) | [289](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L289) | [293](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L293) | [315](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L315) | [319](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L319) | [330](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L330) | [360](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L360) | [365](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L365) | [370](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L370) | [371](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L371) | [376](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L376) | [381](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L381) | [382](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L382) | [391](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L391) | [393](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L393) | [401](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L401) | [404](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L404) | [409](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L409) | [412](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L412) | [417](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L417) | [420](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L420) | [425](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L425) ```solidity File: contracts/legacy/GovernorBravoInterfaces.sol 15: uint id, 18: uint[] values, 21: uint startBlock, 22: uint endBlock, 32: event VoteCast(address indexed voter, uint proposalId, uint8 support, uint votes, string reason); 32: event VoteCast(address indexed voter, uint proposalId, uint8 support, uint votes, string reason); 35: event ProposalCanceled(uint id); 38: event ProposalQueued(uint id, uint eta); 38: event ProposalQueued(uint id, uint eta); 41: event ProposalExecuted(uint id); 44: event VotingDelaySet(uint oldVotingDelay, uint newVotingDelay); 44: event VotingDelaySet(uint oldVotingDelay, uint newVotingDelay); 47: event VotingPeriodSet(uint oldVotingPeriod, uint newVotingPeriod); 47: event VotingPeriodSet(uint oldVotingPeriod, uint newVotingPeriod); 53: event ProposalThresholdSet(uint oldProposalThreshold, uint newProposalThreshold); 53: event ProposalThresholdSet(uint oldProposalThreshold, uint newProposalThreshold); 65: event ProposalMaxOperationsUpdated(uint oldMaxOperations, uint newMaxOperations); 65: event ProposalMaxOperationsUpdated(uint oldMaxOperations, uint newMaxOperations); 90: uint public votingDelay; 93: uint public votingPeriod; 96: uint public proposalThreshold; 99: uint public initialProposalId; 102: uint public proposalCount; 118: uint id; 122: uint eta; 126: uint[] values; 132: uint startBlock; 134: uint endBlock; 136: uint forVotes; 138: uint againstVotes; 140: uint abstainVotes; 172: uint public proposalMaxOperations; ``` [15](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L15) | [18](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L18) | [21](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L21) | [22](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L22) | [32](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L32) | [32](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L32) | [35](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L35) | [38](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L38) | [38](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L38) | [41](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L41) | [44](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L44) | [44](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L44) | [47](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L47) | [47](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L47) | [53](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L53) | [53](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L53) | [65](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L65) | [65](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L65) | [90](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L90) | [93](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L93) | [96](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L96) | [99](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L99) | [102](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L102) | [118](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L118) | [122](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L122) | [126](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L126) | [132](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L132) | [134](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L134) | [136](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L136) | [138](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L138) | [140](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L140) | [172](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L172) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 16: uint public constant MIN_PROPOSAL_THRESHOLD = 150000e18; // 150,000 Xvs 19: uint public constant MAX_PROPOSAL_THRESHOLD = 300000e18; //300,000 Xvs 22: uint public constant MIN_VOTING_PERIOD = 20 * 60 * 3; // About 3 hours, 3 secs per block 25: uint public constant MAX_VOTING_PERIOD = 20 * 60 * 24 * 14; // About 2 weeks, 3 secs per block 28: uint public constant MIN_VOTING_DELAY = 1; 31: uint public constant MAX_VOTING_DELAY = 20 * 60 * 24 * 7; // About 1 week, 3 secs per block 34: uint public constant quorumVotes = 600000e18; // 600,000 = 2% of Xvs 54: uint votingPeriod_, 55: uint votingDelay_, 56: uint proposalThreshold_, 97: uint[] memory values, 101: ) public returns (uint) { 117: uint latestProposalId = latestProposalIds[msg.sender]; 130: uint startBlock = add256(block.number, votingDelay); 131: uint endBlock = add256(startBlock, votingPeriod); 172: function queue(uint proposalId) external { 178: uint eta = add256(block.timestamp, timelock.delay()); 179: for (uint i = 0; i < proposal.targets.length; i++) { 194: uint value, 197: uint eta 210: function execute(uint proposalId) external { 217: for (uint i = 0; i < proposal.targets.length; i++) { 233: function cancel(uint proposalId) external { 245: for (uint i = 0; i < proposal.targets.length; i++) { 264: uint proposalId 268: returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) 280: function getReceipt(uint proposalId, address voter) external view returns (Receipt memory) { 289: function state(uint proposalId) public view returns (ProposalState) { 319: function castVote(uint proposalId, uint8 support) external { 329: function castVoteWithReason(uint proposalId, uint8 support, string calldata reason) external { 337: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external { 355: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) { 395: function _setVotingDelay(uint newVotingDelay) external { 401: uint oldVotingDelay = votingDelay; 411: function _setVotingPeriod(uint newVotingPeriod) external { 417: uint oldVotingPeriod = votingPeriod; 428: function _setProposalThreshold(uint newProposalThreshold) external { 434: uint oldProposalThreshold = proposalThreshold; 458: function _setProposalMaxOperations(uint proposalMaxOperations_) external { 460: uint oldProposalMaxOperations = proposalMaxOperations; 510: function add256(uint256 a, uint256 b) internal pure returns (uint) { 511: uint c = a + b; 516: function sub256(uint256 a, uint256 b) internal pure returns (uint) { 521: function getChainIdInternal() internal pure returns (uint) { 522: uint chainId; ``` [16](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L16) | [19](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L19) | [22](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L22) | [25](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L25) | [28](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L28) | [31](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L31) | [34](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L34) | [54](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L54) | [55](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L55) | [56](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L56) | [97](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L97) | [101](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L101) | [117](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L117) | [130](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L130) | [131](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L131) | [172](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L172) | [178](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L178) | [179](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L179) | [194](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L194) | [197](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L197) | [210](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L210) | [217](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L217) | [233](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L233) | [245](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L245) | [264](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L264) | [268](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L268) | [280](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L280) | [289](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L289) | [319](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L319) | [329](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L329) | [337](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L337) | [355](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L355) | [395](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L395) | [401](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L401) | [411](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L411) | [417](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L417) | [428](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L428) | [434](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L434) | [458](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L458) | [460](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L460) | [510](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L510) | [511](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L511) | [516](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L516) | [521](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L521) | [522](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L522) ```solidity File: contracts/legacy/GovernorAlpha2.sol 9: function quorumVotes() public pure returns (uint) { 14: function proposalThreshold() public pure returns (uint) { 19: function proposalMaxOperations() public pure returns (uint) { 24: function votingDelay() public pure returns (uint) { 29: function votingPeriod() public pure returns (uint) { 43: uint public proposalCount; 47: uint id; 51: uint eta; 55: uint[] values; 61: uint startBlock; 63: uint endBlock; 65: uint forVotes; 67: uint againstVotes; 113: uint id, 116: uint[] values, 119: uint startBlock, 120: uint endBlock, 125: event VoteCast(address voter, uint proposalId, bool support, uint votes); 125: event VoteCast(address voter, uint proposalId, bool support, uint votes); 128: event ProposalCanceled(uint id); 131: event ProposalQueued(uint id, uint eta); 131: event ProposalQueued(uint id, uint eta); 134: event ProposalExecuted(uint id); 145: uint[] memory values, 149: ) public returns (uint) { 163: uint latestProposalId = latestProposalIds[msg.sender]; 176: uint startBlock = add256(block.number, votingDelay()); 177: uint endBlock = add256(startBlock, votingPeriod()); 213: function queue(uint proposalId) public { 219: uint eta = add256(block.timestamp, timelock.delay()); 220: for (uint i = 0; i < proposal.targets.length; i++) { 227: function _queueOrRevert(address target, uint value, string memory signature, bytes memory data, uint eta) internal { 227: function _queueOrRevert(address target, uint value, string memory signature, bytes memory data, uint eta) internal { 235: function execute(uint proposalId) public payable { 242: for (uint i = 0; i < proposal.targets.length; i++) { 254: function cancel(uint proposalId) public { 266: for (uint i = 0; i < proposal.targets.length; i++) { 280: uint proposalId 284: returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) 290: function getReceipt(uint proposalId, address voter) public view returns (Receipt memory) { 294: function state(uint proposalId) public view returns (ProposalState) { 316: function castVote(uint proposalId, bool support) public { 320: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public { 331: function _castVote(address voter, uint proposalId, bool support) internal { 361: function __queueSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { 366: function __executeSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { 371: function add256(uint256 a, uint256 b) internal pure returns (uint) { 372: uint c = a + b; 377: function sub256(uint256 a, uint256 b) internal pure returns (uint) { 382: function getChainId() internal pure returns (uint) { 383: uint chainId; 392: function delay() external view returns (uint); 394: function GRACE_PERIOD() external view returns (uint); 402: uint value, 405: uint eta 410: uint value, 413: uint eta 418: uint value, 421: uint eta 426: function getPriorVotes(address account, uint blockNumber) external view returns (uint96); ``` [9](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L9) | [14](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L14) | [19](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L19) | [24](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L24) | [29](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L29) | [43](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L43) | [47](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L47) | [51](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L51) | [55](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L55) | [61](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L61) | [63](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L63) | [65](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L65) | [67](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L67) | [113](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L113) | [116](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L116) | [119](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L119) | [120](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L120) | [125](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L125) | [125](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L125) | [128](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L128) | [131](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L131) | [131](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L131) | [134](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L134) | [145](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L145) | [149](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L149) | [163](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L163) | [176](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L176) | [177](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L177) | [213](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L213) | [219](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L219) | [220](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L220) | [227](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L227) | [227](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L227) | [235](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L235) | [242](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L242) | [254](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L254) | [266](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L266) | [280](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L280) | [284](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L284) | [290](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L290) | [294](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L294) | [316](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L316) | [320](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L320) | [331](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L331) | [361](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L361) | [366](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L366) | [371](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L371) | [372](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L372) | [377](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L377) | [382](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L382) | [383](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L383) | [392](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L392) | [394](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L394) | [402](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L402) | [405](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L405) | [410](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L410) | [413](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L413) | [418](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L418) | [421](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L421) | [426](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L426) ```solidity File: contracts/Governance/Timelock.sol 11: using SafeMath for uint; 19: event NewDelay(uint indexed newDelay); 25: uint value, 28: uint eta 35: uint value, 38: uint eta 45: uint value, 48: uint eta 52: uint public constant GRACE_PERIOD = 14 days; 55: uint public constant MINIMUM_DELAY = 1 hours; 58: uint public constant MAXIMUM_DELAY = 30 days; 67: uint public delay; 72: constructor(address admin_, uint delay_) public { 86: function setDelay(uint delay_) public { 128: uint value, 131: uint eta 156: uint value, 159: uint eta 179: uint value, 182: uint eta 210: function getBlockTimestamp() internal view returns (uint) { ``` [11](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L11) | [19](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L19) | [25](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L25) | [28](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L28) | [35](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L35) | [38](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L38) | [45](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L45) | [48](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L48) | [52](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L52) | [55](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L55) | [58](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L58) | [67](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L67) | [72](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L72) | [86](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L86) | [128](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L128) | [131](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L131) | [156](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L156) | [159](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L159) | [179](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L179) | [182](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L182) | [210](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L210) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 12: uint id, 15: uint[] values, 18: uint startBlock, 19: uint endBlock, 30: event VoteCast(address indexed voter, uint proposalId, uint8 support, uint votes, string reason); 30: event VoteCast(address indexed voter, uint proposalId, uint8 support, uint votes, string reason); 33: event ProposalCanceled(uint id); 36: event ProposalQueued(uint id, uint eta); 36: event ProposalQueued(uint id, uint eta); 39: event ProposalExecuted(uint id); 42: event VotingDelaySet(uint oldVotingDelay, uint newVotingDelay); 42: event VotingDelaySet(uint oldVotingDelay, uint newVotingDelay); 45: event VotingPeriodSet(uint oldVotingPeriod, uint newVotingPeriod); 45: event VotingPeriodSet(uint oldVotingPeriod, uint newVotingPeriod); 51: event ProposalThresholdSet(uint oldProposalThreshold, uint newProposalThreshold); 51: event ProposalThresholdSet(uint oldProposalThreshold, uint newProposalThreshold); 63: event ProposalMaxOperationsUpdated(uint oldMaxOperations, uint newMaxOperations); 63: event ProposalMaxOperationsUpdated(uint oldMaxOperations, uint newMaxOperations); 90: uint public votingDelay; 93: uint public votingPeriod; 96: uint public proposalThreshold; 99: uint public initialProposalId; 102: uint public proposalCount; 118: uint id; 122: uint eta; 126: uint[] values; 132: uint startBlock; 134: uint endBlock; 136: uint forVotes; 138: uint againstVotes; 140: uint abstainVotes; 174: uint public proposalMaxOperations; 215: function delay() external view returns (uint); 217: function GRACE_PERIOD() external view returns (uint); 225: uint value, 228: uint eta 233: uint value, 236: uint eta 241: uint value, 244: uint eta 249: function getPriorVotes(address account, uint blockNumber) external view returns (uint96); 254: function proposalCount() external returns (uint); ``` [12](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L12) | [15](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L15) | [18](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L18) | [19](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L19) | [30](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L30) | [30](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L30) | [33](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L33) | [36](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L36) | [36](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L36) | [39](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L39) | [42](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L42) | [42](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L42) | [45](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L45) | [45](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L45) | [51](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L51) | [51](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L51) | [63](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L63) | [63](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L63) | [90](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L90) | [93](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L93) | [96](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L96) | [99](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L99) | [102](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L102) | [118](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L118) | [122](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L122) | [126](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L126) | [132](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L132) | [134](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L134) | [136](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L136) | [138](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L138) | [140](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L140) | [174](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L174) | [215](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L215) | [217](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L217) | [225](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L225) | [228](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L228) | [233](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L233) | [236](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L236) | [241](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L241) | [244](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L244) | [249](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L249) | [254](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L254) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 78: uint public constant MIN_PROPOSAL_THRESHOLD = 150000e18; // 150,000 Xvs 81: uint public constant MAX_PROPOSAL_THRESHOLD = 300000e18; //300,000 Xvs 84: uint public constant MIN_VOTING_PERIOD = 20 * 60 * 3; // About 3 hours, 3 secs per block 87: uint public constant MAX_VOTING_PERIOD = 20 * 60 * 24 * 14; // About 2 weeks, 3 secs per block 90: uint public constant MIN_VOTING_DELAY = 1; 93: uint public constant MAX_VOTING_DELAY = 20 * 60 * 24 * 7; // About 1 week, 3 secs per block 96: uint public constant quorumVotes = 600000e18; // 600,000 = 2% of Xvs 183: uint[] memory values, 188: ) public returns (uint) { 205: uint latestProposalId = latestProposalIds[msg.sender]; 218: uint startBlock = add256(block.number, proposalConfigs[uint8(proposalType)].votingDelay); 219: uint endBlock = add256(startBlock, proposalConfigs[uint8(proposalType)].votingPeriod); 262: function queue(uint proposalId) external { 268: uint eta = add256(block.timestamp, proposalTimelocks[uint8(proposal.proposalType)].delay()); 269: for (uint i; i < proposal.targets.length; ++i) { 285: uint value, 288: uint eta, 304: function execute(uint proposalId) external { 311: for (uint i; i < proposal.targets.length; ++i) { 327: function cancel(uint proposalId) external { 340: for (uint i = 0; i < proposal.targets.length; i++) { 359: uint proposalId 363: returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) 375: function getReceipt(uint proposalId, address voter) external view returns (Receipt memory) { 384: function state(uint proposalId) public view returns (ProposalState) { 416: function castVote(uint proposalId, uint8 support) external { 426: function castVoteWithReason(uint proposalId, uint8 support, string calldata reason) external { 439: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external { 457: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) { 513: function _setProposalMaxOperations(uint proposalMaxOperations_) external { 515: uint oldProposalMaxOperations = proposalMaxOperations; 565: function add256(uint256 a, uint256 b) internal pure returns (uint) { 566: uint c = a + b; 571: function sub256(uint256 a, uint256 b) internal pure returns (uint) { 576: function getChainIdInternal() internal pure returns (uint) { 577: uint chainId; ``` [78](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L78) | [81](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L81) | [84](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L84) | [87](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L87) | [90](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L90) | [93](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L93) | [96](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L96) | [183](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L183) | [188](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L188) | [205](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L205) | [218](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L218) | [219](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L219) | [262](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L262) | [268](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L268) | [269](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L269) | [285](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L285) | [288](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L288) | [304](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L304) | [311](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L311) | [327](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L327) | [340](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L340) | [359](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L359) | [363](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L363) | [375](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L375) | [384](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L384) | [416](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L416) | [426](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L426) | [439](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L439) | [457](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L457) | [513](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L513) | [515](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L515) | [565](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L565) | [566](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L566) | [571](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L571) | [576](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L576) | [577](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L577) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 17: uint votingPeriod_, 18: uint votingDelay_, 19: uint proposalThreshold_, ``` [17](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegator.sol#L17) | [18](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegator.sol#L18) | [19](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegator.sol#L19)

### [N-06] Variables need not be initialized to zero By default, `int/uint` variables in Solidity are initialized to `zero`. Explicitly setting variables to zero during their declaration is redundant and might cause confusion. Removing the explicit zero initialization can improve code readability and understanding.

10 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 219: for (uint i = 0; i < proposal.targets.length; i++) { 241: for (uint i = 0; i < proposal.targets.length; i++) { 265: for (uint i = 0; i < proposal.targets.length; i++) { ``` [219](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L219) | [241](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L241) | [265](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L265) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 179: for (uint i = 0; i < proposal.targets.length; i++) { 217: for (uint i = 0; i < proposal.targets.length; i++) { 245: for (uint i = 0; i < proposal.targets.length; i++) { ``` [179](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L179) | [217](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L217) | [245](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L245) ```solidity File: contracts/legacy/GovernorAlpha2.sol 220: for (uint i = 0; i < proposal.targets.length; i++) { 242: for (uint i = 0; i < proposal.targets.length; i++) { 266: for (uint i = 0; i < proposal.targets.length; i++) { ``` [220](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L220) | [242](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L242) | [266](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L266) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 340: for (uint i = 0; i < proposal.targets.length; i++) { ``` [340](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L340)

### [N-07] Multiple Interfaces in Single File Declaring multiple Interfaces within a single file can make code more difficult to understand and maintain. It is recommended to declare each interfaces in its own file.

7 issue instances in 3 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 390: interface TimelockInterface 424: interface XVSInterface ``` [390](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L390) | [424](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L424) ```solidity File: contracts/legacy/GovernorAlpha2.sol 391: interface TimelockInterface 425: interface XVSInterface ``` [391](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L391) | [425](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L425) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 214: interface TimelockInterface 248: interface XvsVaultInterface 252: interface GovernorAlphaInterface ``` [214](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L214) | [248](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L248) | [252](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L252)

### [N-08] Multiple `address`/ID mappings can be combined into a single `mapping` of an `address`/ID to a `struct`, for readability Combining multiple address/ID mappings into a single mapping to a struct can enhance code clarity and maintainability. Consider refactoring multiple mappings into a single mapping with a struct for cleaner code structure. This arrangement also promotes a more organized contract structure, making it easier for developers to navigate and understand.

3 issue instances in 1 files:

```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 111: mapping(uint => Proposal) public proposals 203: mapping(uint => ProposalConfig) public proposalConfigs 206: mapping(uint => TimelockInterface) public proposalTimelocks ``` [111](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L111) | [203](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L203) | [206](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L206)

### [N-09] Consider returning a `struct` rather than having multiple `return` values Functions that return many variables can become difficult to read and maintain. Using a struct to encapsulate these return values can improve code readability, increase reusability, and reduce the likelihood of errors. Consider refactoring functions that return more than three variables to use a struct instead.

4 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 278: function getActions( uint proposalId ) public view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) ``` [278](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L278) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 263: function getActions( uint proposalId ) external view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) ``` [263](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L263) ```solidity File: contracts/legacy/GovernorAlpha2.sol 279: function getActions( uint proposalId ) public view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) ``` [279](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L279) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 358: function getActions( uint proposalId ) external view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) ``` [358](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L358)

### [N-10] Consider using a `struct` rather than having many function input parameters Functions with many parameters can become difficult to read and maintain. Using a struct to encapsulate these parameters can improve code readability, increase reusability, and reduce the likelihood of errors. Consider refactoring functions that take more than three parameters to use a struct instead.

20 issue instances in 7 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 142: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) 226: function _queueOrRevert(address target, uint value, string memory signature, bytes memory data, uint eta) internal 319: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public ``` [142](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L142) | [226](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L226) | [319](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L319) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 51: function initialize( address timelock_, address xvsVault_, uint votingPeriod_, uint votingDelay_, uint proposalThreshold_, address guardian_ ) public 95: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) 192: function queueOrRevertInternal( address target, uint value, string memory signature, bytes memory data, uint eta ) internal 337: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external ``` [51](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L51) | [95](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L95) | [192](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L192) | [337](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L337) ```solidity File: contracts/legacy/GovernorAlpha2.sol 143: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) 227: function _queueOrRevert(address target, uint value, string memory signature, bytes memory data, uint eta) internal 320: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public ``` [143](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L143) | [227](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L227) | [320](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L320) ```solidity File: contracts/Governance/Timelock.sol 126: function queueTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public returns (bytes32) 154: function cancelTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public 177: function executeTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public payable returns (bytes memory) ``` [126](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L126) | [154](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L154) | [177](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L177) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 181: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description, ProposalType proposalType ) public returns (uint) 283: function queueOrRevertInternal( address target, uint value, string memory signature, bytes memory data, uint eta, uint8 proposalType ) internal 439: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external ``` [181](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L181) | [283](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L283) | [439](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L439) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 12: constructor( address timelock_, address xvsVault_, address admin_, address implementation_, uint votingPeriod_, uint votingDelay_, uint proposalThreshold_, address guardian_ ) public ``` [12](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegator.sol#L12) ```solidity File: contracts/Governance/TimelockV8.sol 141: function queueTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public returns (bytes32) 169: function cancelTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public 192: function executeTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public payable returns (bytes memory) ``` [141](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L141) | [169](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L169) | [192](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L192)

### [N-11] Simplify complex require statements Simplifying complex require statements with local variables and if(or revert) statements can improve readability, make debugging easier, and promote modularity and reusability in the code.

6 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 153: require( targets.length == values.length && targets.length == signatures.length && targets.length == calldatas.length, "GovernorAlpha::propose: proposal function information arity mismatch" ) ``` [153](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L153) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 108: require( targets.length == values.length && targets.length == signatures.length && targets.length == calldatas.length, "GovernorBravo::propose: proposal function information arity mismatch" ) 237: require( msg.sender == guardian || msg.sender == proposal.proposer || xvsVault.getPriorVotes(proposal.proposer, sub256(block.number, 1)) < proposalThreshold, "GovernorBravo::cancel: proposer above threshold" ) ``` [108](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L108) | [237](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L237) ```solidity File: contracts/legacy/GovernorAlpha2.sol 154: require( targets.length == values.length && targets.length == signatures.length && targets.length == calldatas.length, "GovernorAlpha::propose: proposal function information arity mismatch" ) ``` [154](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L154) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 196: require( targets.length == values.length && targets.length == signatures.length && targets.length == calldatas.length, "GovernorBravo::propose: proposal function information arity mismatch" ) 331: require( msg.sender == guardian || msg.sender == proposal.proposer || xvsVault.getPriorVotes(proposal.proposer, sub256(block.number, 1)) < proposalConfigs[proposal.proposalType].proposalThreshold, "GovernorBravo::cancel: proposer above threshold" ) ``` [196](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L196) | [331](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L331)

### [N-12] Consider using descriptive `constant`s when passing zero as a function argument In instances where utilizing a zero parameter is essential, it is recommended to employ descriptive constants or an enum instead of directly integrating zero within function calls. This strategy aids in clearly articulating the caller's intention and minimizes the risk of errors. Emitting zero also not recomended, as it is not clear what the intention is.

4 issue instances in 2 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 362: timelock.queueTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta) 367: timelock.executeTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta) ``` [362](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L362) | [367](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L367) ```solidity File: contracts/legacy/GovernorAlpha2.sol 363: timelock.queueTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta) 368: timelock.executeTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta) ``` [363](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L363) | [368](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L368)

### [N-13] Avoid Empty Blocks in Code Empty blocks in code can lead to confusion and the introduction of errors when the code is later modified. They should be removed, or the block should do something useful, such as emitting an event or reverting. For contracts meant to be extended, the contract should be abstract and the function signatures added without any default implementation.

2 issue instances in 2 files:

```solidity File: contracts/Governance/Timelock.sol 80: function() external payable {} ``` [80](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L80) ```solidity File: contracts/Governance/TimelockV8.sol 82: fallback() external payable {} ``` [82](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L82)

### [N-14] Interfaces and Contracts in the Same File Interfaces should be declared in a separate file and not in the same file where the contract resides. This helps in maintaining a clean and organized codebase.

13 issue instances in 3 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 390: interface TimelockInterface 424: interface XVSInterface 4: contract GovernorAlpha ``` [390](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L390) | [424](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L424) | [4](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L4) ```solidity File: contracts/legacy/GovernorAlpha2.sol 391: interface TimelockInterface 425: interface XVSInterface 4: contract GovernorAlpha2 ``` [391](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L391) | [425](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L425) | [4](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L4) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 214: interface TimelockInterface 248: interface XvsVaultInterface 252: interface GovernorAlphaInterface 9: contract GovernorBravoEvents 71: contract GovernorBravoDelegatorStorage 88: contract GovernorBravoDelegateStorageV1 186: contract GovernorBravoDelegateStorageV2 ``` [214](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L214) | [248](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L248) | [252](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L252) | [9](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L9) | [71](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L71) | [88](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L88) | [186](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L186)

### [N-15] Multiple Contracts Declared in Single File Declaring multiple contracts within a single file can make code more difficult to understand and maintain. It is recommended to declare each contract in its own file, following the one contract per file rule.

7 issue instances in 2 files:

```solidity File: contracts/legacy/GovernorBravoInterfaces.sol 12: contract GovernorBravoEventsV1 73: contract GovernorBravoDelegatorStorage 88: contract GovernorBravoDelegateStorageV1 ``` [12](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L12) | [73](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L73) | [88](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L88) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 9: contract GovernorBravoEvents 71: contract GovernorBravoDelegatorStorage 88: contract GovernorBravoDelegateStorageV1 186: contract GovernorBravoDelegateStorageV2 ``` [9](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L9) | [71](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L71) | [88](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L88) | [186](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L186)

### [N-16] `uint/int` variables should have the bit size defined explicitly In Solidity, int256 and uint256 are the preferred type names, especially since they are used for function signatures. Using int or uint instead can lead to confusion and inconsistency.

299 issue instances in 8 files:

### [N-17] Consider using `delete` rather than assigning `false` to clear values The use of the delete keyword is recommended over simply assigning values to false when you intend to reset the state of a variable. The delete keyword more closely aligns with the semantic intent of clearing or resetting a variable. This practice also makes the code more readable and highlights the change in state, which may encourage a more thorough audit of the surrounding logic.

4 issue instances in 2 files:

```solidity File: contracts/Governance/Timelock.sol 164: queuedTransactions[txHash] = false 191: queuedTransactions[txHash] = false ``` [164](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L164) | [191](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L191) ```solidity File: contracts/Governance/TimelockV8.sol 179: queuedTransactions[txHash] = false 206: queuedTransactions[txHash] = false ``` [179](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L179) | [206](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L206)

### [N-18] Consider emitting an event at the end of the constructor This will allow users to easily exactly pinpoint when and by whom a contract was constructed.

6 issue instances in 6 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 136: constructor(address timelock_, address xvs_, address guardian_) public ``` [136](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L136) ```solidity File: contracts/legacy/GovernorAlpha2.sol 136: constructor(address timelock_, address xvs_, address guardian_, uint256 lastProposalId_) public ``` [136](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L136) ```solidity File: contracts/Governance/Timelock.sol 72: constructor(address admin_, uint delay_) public ``` [72](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L72) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 12: constructor( address timelock_, address xvsVault_, address admin_, address implementation_, uint votingPeriod_, uint votingDelay_, uint proposalThreshold_, address guardian_ ) public ``` [12](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegator.sol#L12) ```solidity File: contracts/Governance/AccessControlManager.sol 61: constructor() ``` [61](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/AccessControlManager.sol#L61) ```solidity File: contracts/Governance/TimelockV8.sol 73: constructor(address admin_, uint256 delay_) ``` [73](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L73)

### [N-19] Consider moving duplicated strings to constants Reusing string literals in this manner can lead to inconsistencies and makes the code harder to maintain. It's recommended to define such strings as constants, which promotes easier updates and ensures uniformity across the codebase.

8 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 362: "setPendingAdmin(address)" 367: "setPendingAdmin(address)" ``` [362](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L362) | [367](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L367) ```solidity File: contracts/legacy/GovernorAlpha2.sol 363: "setPendingAdmin(address)" 368: "setPendingAdmin(address)" ``` [363](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L363) | [368](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L368) ```solidity File: contracts/Governance/Timelock.sol 74: "Timelock::setDelay: Delay must not exceed maximum delay." 89: "Timelock::setDelay: Delay must not exceed maximum delay." ``` [74](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L74) | [89](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L89) ```solidity File: contracts/Governance/TimelockV8.sol 75: "Timelock::setDelay: Delay must not exceed maximum delay." 91: "Timelock::setDelay: Delay must not exceed maximum delay." ``` [75](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L75) | [91](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L91)

### [N-20] Consider using named returns Using named returns makes the code more self-documenting, makes it easier to fill out NatSpec, and in some cases can save gas. The cases below are where there currently is at most one return statement, which is ideal for named returns.

49 issue instances in 9 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 9: function quorumVotes() public pure returns (uint) 14: function proposalThreshold() public pure returns (uint) 19: function proposalMaxOperations() public pure returns (uint) 24: function votingDelay() public pure returns (uint) 29: function votingPeriod() public pure returns (uint) 142: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) 289: function getReceipt(uint proposalId, address voter) public view returns (Receipt memory) 293: function state(uint proposalId) public view returns (ProposalState) 370: function add256(uint256 a, uint256 b) internal pure returns (uint) 376: function sub256(uint256 a, uint256 b) internal pure returns (uint) 381: function getChainId() internal pure returns (uint) ``` [9](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L9) | [14](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L14) | [19](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L19) | [24](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L24) | [29](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L29) | [142](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L142) | [289](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L289) | [293](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L293) | [370](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L370) | [376](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L376) | [381](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L381) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 95: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) 280: function getReceipt(uint proposalId, address voter) external view returns (Receipt memory) 289: function state(uint proposalId) public view returns (ProposalState) 355: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) 510: function add256(uint256 a, uint256 b) internal pure returns (uint) 516: function sub256(uint256 a, uint256 b) internal pure returns (uint) 521: function getChainIdInternal() internal pure returns (uint) ``` [95](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L95) | [280](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L280) | [289](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L289) | [355](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L355) | [510](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L510) | [516](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L516) | [521](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L521) ```solidity File: contracts/legacy/GovernorAlpha2.sol 9: function quorumVotes() public pure returns (uint) 14: function proposalThreshold() public pure returns (uint) 19: function proposalMaxOperations() public pure returns (uint) 24: function votingDelay() public pure returns (uint) 29: function votingPeriod() public pure returns (uint) 143: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) 290: function getReceipt(uint proposalId, address voter) public view returns (Receipt memory) 294: function state(uint proposalId) public view returns (ProposalState) 371: function add256(uint256 a, uint256 b) internal pure returns (uint) 377: function sub256(uint256 a, uint256 b) internal pure returns (uint) 382: function getChainId() internal pure returns (uint) ``` [9](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L9) | [14](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L14) | [19](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L19) | [24](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L24) | [29](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L29) | [143](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L143) | [290](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L290) | [294](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L294) | [371](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L371) | [377](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L377) | [382](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L382) ```solidity File: contracts/Governance/AccessControlledV8.sol 55: function accessControlManager() external view returns (IAccessControlManagerV8) ``` [55](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/AccessControlledV8.sol#L55) ```solidity File: contracts/Governance/Timelock.sol 126: function queueTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public returns (bytes32) 177: function executeTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public payable returns (bytes memory) 210: function getBlockTimestamp() internal view returns (uint) ``` [126](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L126) | [177](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L177) | [210](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/Timelock.sol#L210) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 181: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description, ProposalType proposalType ) public returns (uint) 375: function getReceipt(uint proposalId, address voter) external view returns (Receipt memory) 384: function state(uint proposalId) public view returns (ProposalState) 457: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) 565: function add256(uint256 a, uint256 b) internal pure returns (uint) 571: function sub256(uint256 a, uint256 b) internal pure returns (uint) 576: function getChainIdInternal() internal pure returns (uint) ``` [181](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L181) | [375](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L375) | [384](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L384) | [457](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L457) | [565](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L565) | [571](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L571) | [576](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L576) ```solidity File: contracts/Governance/AccessControlManager.sol 109: function isAllowedToCall(address account, string calldata functionSig) public view returns (bool) 128: function hasPermission( address account, address contractAddress, string calldata functionSig ) public view returns (bool) ``` [109](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/AccessControlManager.sol#L109) | [128](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/AccessControlManager.sol#L128) ```solidity File: contracts/Governance/TimelockV8.sol 97: function GRACE_PERIOD() public view virtual returns (uint256) 101: function MINIMUM_DELAY() public view virtual returns (uint256) 105: function MAXIMUM_DELAY() public view virtual returns (uint256) 141: function queueTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public returns (bytes32) 192: function executeTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public payable returns (bytes memory) 225: function getBlockTimestamp() internal view returns (uint256) ``` [97](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L97) | [101](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L101) | [105](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L105) | [141](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L141) | [192](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L192) | [225](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/TimelockV8.sol#L225) ```solidity File: contracts/Governance/AccessControlledV5.sol 29: function accessControlManager() external view returns (IAccessControlManagerV5) ``` [29](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/AccessControlledV5.sol#L29)

### [N-21] Expressions for constant values should use `immutable` rather than `constant` While it does not save gas for some simple binary expressions because the compiler knows that developers often make this mistake, it's still best to use the right tool for the task at hand. There is a difference between `constant` variables and immutable variables, and they should each be used in their appropriate contexts. `constant`s should be used for literal values written into the code, and immutable variables should be used for expressions, or values calculated in, or passed into the constructor.

14 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 105: bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)") 109: bytes32 public constant BALLOT_TYPEHASH = keccak256("Ballot(uint256 proposalId,bool support)") ``` [105](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L105) | [109](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L109) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 22: uint public constant MIN_VOTING_PERIOD = 20 * 60 * 3 25: uint public constant MAX_VOTING_PERIOD = 20 * 60 * 24 * 14 31: uint public constant MAX_VOTING_DELAY = 20 * 60 * 24 * 7 37: bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)") 41: bytes32 public constant BALLOT_TYPEHASH = keccak256("Ballot(uint256 proposalId,uint8 support)") ``` [22](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L22) | [25](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L25) | [31](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L31) | [37](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L37) | [41](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L41) ```solidity File: contracts/legacy/GovernorAlpha2.sol 105: bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)") 109: bytes32 public constant BALLOT_TYPEHASH = keccak256("Ballot(uint256 proposalId,bool support)") ``` [105](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L105) | [109](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L109) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 84: uint public constant MIN_VOTING_PERIOD = 20 * 60 * 3 87: uint public constant MAX_VOTING_PERIOD = 20 * 60 * 24 * 14 93: uint public constant MAX_VOTING_DELAY = 20 * 60 * 24 * 7 99: bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)") 103: bytes32 public constant BALLOT_TYPEHASH = keccak256("Ballot(uint256 proposalId,uint8 support)") ``` [84](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L84) | [87](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L87) | [93](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L93) | [99](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L99) | [103](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L103)

### [N-22] Consider using named function arguments When calling functions in external contracts with multiple arguments, consider using named function parameters, rather than positional ones.

28 issue instances in 6 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 150: xvs.getPriorVotes(msg.sender, sub256(block.number, 1)) 231: timelock.queueTransaction(target, value, signature, data, eta) 260: xvs.getPriorVotes(proposal.proposer, sub256(block.number, 1)) 266: timelock.cancelTransaction( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], proposal.eta ) 335: xvs.getPriorVotes(voter, proposal.startBlock) 362: timelock.queueTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta) 367: timelock.executeTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta) ``` [150](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L150) | [231](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L231) | [260](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L260) | [266](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L266) | [335](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L335) | [362](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L362) | [367](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha.sol#L367) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 105: xvsVault.getPriorVotes(msg.sender, sub256(block.number, 1)) 203: timelock.queueTransaction(target, value, signature, data, eta) 218: timelock.executeTransaction( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], proposal.eta ) 240: xvsVault.getPriorVotes(proposal.proposer, sub256(block.number, 1)) 246: timelock.cancelTransaction( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], proposal.eta ) 361: xvsVault.getPriorVotes(voter, proposal.startBlock) ``` [105](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L105) | [203](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L203) | [218](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L218) | [240](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L240) | [246](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L246) | [361](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L361) ```solidity File: contracts/legacy/GovernorAlpha2.sol 151: xvs.getPriorVotes(msg.sender, sub256(block.number, 1)) 232: timelock.queueTransaction(target, value, signature, data, eta) 261: xvs.getPriorVotes(proposal.proposer, sub256(block.number, 1)) 267: timelock.cancelTransaction( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], proposal.eta ) 336: xvs.getPriorVotes(voter, proposal.startBlock) 363: timelock.queueTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta) 368: timelock.executeTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta) ``` [151](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L151) | [232](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L232) | [261](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L261) | [267](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L267) | [336](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L336) | [363](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L363) | [368](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/legacy/GovernorAlpha2.sol#L368) ```solidity File: contracts/Governance/AccessControlledV8.sol 75: _accessControlManager.isAllowedToCall(msg.sender, signature) ``` [75](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/AccessControlledV8.sol#L75) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 192: xvsVault.getPriorVotes(msg.sender, sub256(block.number, 1)) 297: proposalTimelocks[proposalType].queueTransaction(target, value, signature, data, eta) 312: proposalTimelocks[uint8(proposal.proposalType)].executeTransaction( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], proposal.eta ) 334: xvsVault.getPriorVotes(proposal.proposer, sub256(block.number, 1)) 341: proposalTimelocks[proposal.proposalType].cancelTransaction( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], proposal.eta ) 463: xvsVault.getPriorVotes(voter, proposal.startBlock) ``` [192](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L192) | [297](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L297) | [312](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L312) | [334](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L334) | [341](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L341) | [463](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/GovernorBravoDelegate.sol#L463) ```solidity File: contracts/Governance/AccessControlledV5.sol 49: _accessControlManager.isAllowedToCall(msg.sender, signature) ``` [49](https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/AccessControlledV5.sol#L49)

### [N-23] For loops in public or external functions should be avoided due to high gas costs and possible `revert` Loops in public or external functions can lead to high gas costs, as their unpredictable gas consumption and externally-influenced logic might make these functions costly.

14 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 219: for (uint i = 0; i < proposal.targets.length; i++) { 241: for (uint i = 0; i < proposal.targets.length; i++) { 265: for (uint i = 0; i < proposal.targets.length; i++) { ``` [219](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L219) | [241](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L241) | [265](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L265) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 179: for (uint i = 0; i < proposal.targets.length; i++) { 217: for (uint i = 0; i < proposal.targets.length; i++) { 245: for (uint i = 0; i < proposal.targets.length; i++) { ``` [179](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L179) | [217](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L217) | [245](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L245) ```solidity File: contracts/legacy/GovernorAlpha2.sol 220: for (uint i = 0; i < proposal.targets.length; i++) { 242: for (uint i = 0; i < proposal.targets.length; i++) { 266: for (uint i = 0; i < proposal.targets.length; i++) { ``` [220](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L220) | [242](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L242) | [266](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L266) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 136: for (uint256 i; i < arrLength; ++i) { 269: for (uint i; i < proposal.targets.length; ++i) { 311: for (uint i; i < proposal.targets.length; ++i) { 340: for (uint i = 0; i < proposal.targets.length; i++) { 503: for (uint256 i; i < uint8(ProposalType.CRITICAL) + 1; ++i) { ``` [136](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L136) | [269](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L269) | [311](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L311) | [340](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L340) | [503](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L503)

### [N-24] Function Parameters in Public Accessible Functions Need `address(0)` Check Parameters of type `address` in your functions should be checked to ensure that they are not assigned the null address (`address(0x0)`). Failure to validate these parameters can lead to transaction reverts, wasted gas, the need for transaction resubmission, and may even require redeployment of contracts within the protocol in certain situations. Implement checks for `address(0x0)` to avoid these potential issues.

29 issue instances in 8 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit `targets` parameter without address(0) check 142: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { /// @audit `voter` parameter without address(0) check 289: function getReceipt(uint proposalId, address voter) public view returns (Receipt memory) { /// @audit `newPendingAdmin` parameter without address(0) check 360: function __queueSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { /// @audit `newPendingAdmin` parameter without address(0) check 365: function __executeSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { ``` [142](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L142) | [289](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L289) | [360](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L360) | [365](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L365) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit `targets` parameter without address(0) check 95: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { /// @audit `voter` parameter without address(0) check 280: function getReceipt(uint proposalId, address voter) external view returns (Receipt memory) { /// @audit `governorAlpha` parameter without address(0) check 445: function _initiate(address governorAlpha) external { /// @audit `newPendingAdmin` parameter without address(0) check 471: function _setPendingAdmin(address newPendingAdmin) external { ``` [95](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L95) | [280](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L280) | [445](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L445) | [471](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L471) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit `targets` parameter without address(0) check 143: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { /// @audit `voter` parameter without address(0) check 290: function getReceipt(uint proposalId, address voter) public view returns (Receipt memory) { /// @audit `newPendingAdmin` parameter without address(0) check 361: function __queueSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { /// @audit `newPendingAdmin` parameter without address(0) check 366: function __executeSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { ``` [143](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L143) | [290](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L290) | [361](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L361) | [366](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L366) ```solidity File: contracts/Governance/AccessControlledV8.sol /// @audit `accessControlManager_` parameter without address(0) check 48: function setAccessControlManager(address accessControlManager_) external onlyOwner { ``` [48](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L48) ```solidity File: contracts/Governance/Timelock.sol /// @audit `pendingAdmin_` parameter without address(0) check 110: function setPendingAdmin(address pendingAdmin_) public { /// @audit `target` parameter without address(0) check 126: function queueTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public returns (bytes32) { /// @audit `target` parameter without address(0) check 154: function cancelTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public { /// @audit `target` parameter without address(0) check 177: function executeTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public payable returns (bytes memory) { ``` [110](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L110) | [126](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L126) | [154](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L154) | [177](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L177) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit `targets` parameter without address(0) check 181: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description, ProposalType proposalType ) public returns (uint) { /// @audit `voter` parameter without address(0) check 375: function getReceipt(uint proposalId, address voter) external view returns (Receipt memory) { /// @audit `governorAlpha` parameter without address(0) check 498: function _initiate(address governorAlpha) external { /// @audit `newPendingAdmin` parameter without address(0) check 526: function _setPendingAdmin(address newPendingAdmin) external { ``` [181](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L181) | [375](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L375) | [498](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L498) | [526](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L526) ```solidity File: contracts/Governance/AccessControlManager.sol /// @audit `contractAddress` parameter without address(0) check /// @audit `accountToPermit` parameter without address(0) check 77: function giveCallPermission(address contractAddress, string calldata functionSig, address accountToPermit) public { /// @audit `contractAddress` parameter without address(0) check /// @audit `accountToRevoke` parameter without address(0) check 91: function revokeCallPermission( address contractAddress, string calldata functionSig, address accountToRevoke ) public { /// @audit `account` parameter without address(0) check 109: function isAllowedToCall(address account, string calldata functionSig) public view returns (bool) { /// @audit `account` parameter without address(0) check /// @audit `contractAddress` parameter without address(0) check 128: function hasPermission( address account, address contractAddress, string calldata functionSig ) public view returns (bool) { ``` [77](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L77) | [91](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L91) | [109](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L109) | [128](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L128) ```solidity File: contracts/Governance/TimelockV8.sol /// @audit `pendingAdmin_` parameter without address(0) check 124: function setPendingAdmin(address pendingAdmin_) public { /// @audit `target` parameter without address(0) check 141: function queueTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public returns (bytes32) { /// @audit `target` parameter without address(0) check 169: function cancelTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public { /// @audit `target` parameter without address(0) check 192: function executeTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public payable returns (bytes memory) { ``` [124](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L124) | [141](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L141) | [169](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L169) | [192](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L192)

### [N-25] Events are missing sender information Events should include the sender information when emitted in `public` or `external` functions for better traceability.

42 issue instances in 8 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit public function `queue()` emits an event without sender information 223: emit ProposalQueued(proposalId, eta); /// @audit public function `execute()` emits an event without sender information 250: emit ProposalExecuted(proposalId); /// @audit public function `cancel()` emits an event without sender information 274: emit ProposalCanceled(proposalId); ``` [223](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L223) | [250](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L250) | [274](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L274) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit external function `queue()` emits an event without sender information 189: emit ProposalQueued(proposalId, eta); /// @audit external function `execute()` emits an event without sender information 226: emit ProposalExecuted(proposalId); /// @audit external function `cancel()` emits an event without sender information 254: emit ProposalCanceled(proposalId); /// @audit external function `castVoteBySig()` emits an event without sender information 345: emit VoteCast(signatory, proposalId, support, castVoteInternal(signatory, proposalId, support), ""); /// @audit external function `_setGuardian()` emits an event without sender information 387: emit NewGuardian(oldGuardian, newGuardian); /// @audit external function `_setVotingDelay()` emits an event without sender information 403: emit VotingDelaySet(oldVotingDelay, votingDelay); /// @audit external function `_setVotingPeriod()` emits an event without sender information 419: emit VotingPeriodSet(oldVotingPeriod, votingPeriod); /// @audit external function `_setProposalThreshold()` emits an event without sender information 436: emit ProposalThresholdSet(oldProposalThreshold, proposalThreshold); /// @audit external function `_setProposalMaxOperations()` emits an event without sender information 462: emit ProposalMaxOperationsUpdated(oldProposalMaxOperations, proposalMaxOperations_); /// @audit external function `_setPendingAdmin()` emits an event without sender information 482: emit NewPendingAdmin(oldPendingAdmin, newPendingAdmin); /// @audit external function `_acceptAdmin()` emits an event without sender information 505: emit NewAdmin(oldAdmin, admin); /// @audit external function `_acceptAdmin()` emits an event without sender information 507: emit NewPendingAdmin(oldPendingAdmin, pendingAdmin); ``` [189](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L189) | [226](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L226) | [254](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L254) | [345](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L345) | [387](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L387) | [403](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L403) | [419](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L419) | [436](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L436) | [462](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L462) | [482](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L482) | [505](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L505) | [507](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L507) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit public function `queue()` emits an event without sender information 224: emit ProposalQueued(proposalId, eta); /// @audit public function `execute()` emits an event without sender information 251: emit ProposalExecuted(proposalId); /// @audit public function `cancel()` emits an event without sender information 275: emit ProposalCanceled(proposalId); ``` [224](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L224) | [251](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L251) | [275](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L275) ```solidity File: contracts/Governance/Timelock.sol /// @audit public function `setDelay()` emits an event without sender information 91: emit NewDelay(delay); /// @audit public function `acceptAdmin()` emits an event without sender information 102: emit NewAdmin(admin); /// @audit public function `setPendingAdmin()` emits an event without sender information 113: emit NewPendingAdmin(pendingAdmin); /// @audit public function `queueTransaction()` emits an event without sender information 141: emit QueueTransaction(txHash, target, value, signature, data, eta); /// @audit public function `cancelTransaction()` emits an event without sender information 165: emit CancelTransaction(txHash, target, value, signature, data, eta); /// @audit public function `executeTransaction()` emits an event without sender information 204: emit ExecuteTransaction(txHash, target, value, signature, data, eta); ``` [91](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L91) | [102](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L102) | [113](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L113) | [141](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L141) | [165](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L165) | [204](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L204) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit external function `queue()` emits an event without sender information 280: emit ProposalQueued(proposalId, eta); /// @audit external function `execute()` emits an event without sender information 320: emit ProposalExecuted(proposalId); /// @audit external function `cancel()` emits an event without sender information 349: emit ProposalCanceled(proposalId); /// @audit external function `castVoteBySig()` emits an event without sender information 447: emit VoteCast(signatory, proposalId, support, castVoteInternal(signatory, proposalId, support), ""); /// @audit external function `_setGuardian()` emits an event without sender information 489: emit NewGuardian(oldGuardian, newGuardian); /// @audit external function `_setProposalMaxOperations()` emits an event without sender information 517: emit ProposalMaxOperationsUpdated(oldProposalMaxOperations, proposalMaxOperations_); /// @audit external function `_setPendingAdmin()` emits an event without sender information 537: emit NewPendingAdmin(oldPendingAdmin, newPendingAdmin); /// @audit external function `_acceptAdmin()` emits an event without sender information 560: emit NewAdmin(oldAdmin, admin); /// @audit external function `_acceptAdmin()` emits an event without sender information 562: emit NewPendingAdmin(oldPendingAdmin, pendingAdmin); ``` [280](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L280) | [320](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L320) | [349](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L349) | [447](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L447) | [489](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L489) | [517](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L517) | [537](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L537) | [560](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L560) | [562](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L562) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol /// @audit public function `_setImplementation()` emits an event without sender information 56: emit NewImplementation(oldImplementation, implementation); ``` [56](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L56) ```solidity File: contracts/Governance/AccessControlManager.sol /// @audit public function `giveCallPermission()` emits an event without sender information 80: emit PermissionGranted(accountToPermit, contractAddress, functionSig); /// @audit public function `revokeCallPermission()` emits an event without sender information 98: emit PermissionRevoked(accountToRevoke, contractAddress, functionSig); ``` [80](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L80) | [98](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L98) ```solidity File: contracts/Governance/TimelockV8.sol /// @audit public function `setDelay()` emits an event without sender information 93: emit NewDelay(delay); /// @audit public function `acceptAdmin()` emits an event without sender information 116: emit NewAdmin(admin); /// @audit public function `setPendingAdmin()` emits an event without sender information 128: emit NewPendingAdmin(pendingAdmin); /// @audit public function `queueTransaction()` emits an event without sender information 156: emit QueueTransaction(txHash, target, value, signature, data, eta); /// @audit public function `cancelTransaction()` emits an event without sender information 180: emit CancelTransaction(txHash, target, value, signature, data, eta); /// @audit public function `executeTransaction()` emits an event without sender information 219: emit ExecuteTransaction(txHash, target, value, signature, data, eta); ``` [93](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L93) | [116](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L116) | [128](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L128) | [156](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L156) | [180](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L180) | [219](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L219)

### [N-26] Leverage Recent Solidity Features with `0.8.23` The recent updates in Solidity provide several features and optimizations that, when leveraged appropriately, can significantly improve your contract's code clarity and maintainability. Key enhancements include the use of push0 for placing 0 on the stack for EVM versions starting from "Shanghai", making your code simpler and more straightforward. Moreover, Solidity has extended NatSpec documentation support to enum and struct definitions, facilitating more comprehensive and insightful code documentation. Additionally, the re-implementation of the UnusedAssignEliminator and UnusedStoreEliminator in the Solidity optimizer provides the ability to remove unused assignments in deeply nested loops. This results in a cleaner, more efficient contract code, reducing clutter and potential points of confusion during code review or debugging. It's recommended to make full use of these features and optimizations to enhance the robustness and readability of your smart contracts.

14 issue instances in 14 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 1: pragma solidity ^0.5.16; ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L1) ```solidity File: contracts/legacy/GovernorBravoInterfaces.sol 1: pragma solidity ^0.5.16; ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L1) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 1: pragma solidity ^0.5.16; ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L1) ```solidity File: contracts/legacy/GovernorAlpha2.sol 1: pragma solidity ^0.5.16; ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L1) ```solidity File: contracts/Governance/IAccessControlManagerV8.sol 2: pragma solidity 0.8.13; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV8.sol#L2) ```solidity File: contracts/Governance/AccessControlledV8.sol 2: pragma solidity 0.8.13; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L2) ```solidity File: contracts/Governance/Timelock.sol 1: pragma solidity ^0.5.16; ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L1) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 1: pragma solidity ^0.5.16; ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L1) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 1: pragma solidity ^0.5.16; ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L1) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 1: pragma solidity ^0.5.16; ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L1) ```solidity File: contracts/Governance/AccessControlManager.sol 2: pragma solidity 0.8.13; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L2) ```solidity File: contracts/Governance/TimelockV8.sol 2: pragma solidity 0.8.13; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L2) ```solidity File: contracts/Governance/AccessControlledV5.sol 2: pragma solidity 0.5.16; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV5.sol#L2) ```solidity File: contracts/Governance/IAccessControlManagerV5.sol 2: pragma solidity 0.5.16; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV5.sol#L2)

### [N-27] `pragma experimental ABIEncoderV2` is deprecated Use `pragma abicoder v2` [instead](https://github.com/ethereum/solidity/blob/69411436139acf5dbcfc5828446f18b9fcfee32c/docs/080-breaking-changes.rst#silent-changes-of-the-semantics)

7 issue instances in 7 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 2: pragma experimental ABIEncoderV2; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L2) ```solidity File: contracts/legacy/GovernorBravoInterfaces.sol 2: pragma experimental ABIEncoderV2; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L2) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 2: pragma experimental ABIEncoderV2; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L2) ```solidity File: contracts/legacy/GovernorAlpha2.sol 2: pragma experimental ABIEncoderV2; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L2) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 2: pragma experimental ABIEncoderV2; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L2) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 2: pragma experimental ABIEncoderV2; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L2) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 2: pragma experimental ABIEncoderV2; ``` [2](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L2)

### [N-28] High cyclomatic complexity Functions with high cyclomatic complexity are harder to understand, test, and maintain. Consider breaking down these blocks into more manageable units, by splitting things into utility functions, by reducing nesting, and by using early returns. [Learn More About Cyclomatic Complexity](https://en.wikipedia.org/wiki/Cyclomatic_complexity)

4 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit function `state` has a cyclomatic complexity of 8 292: function state(uint proposalId) public view returns (ProposalState) { ``` [292](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L292) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit function `state` has a cyclomatic complexity of 8 289: function state(uint proposalId) public view returns (ProposalState) { ``` [289](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L289) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit function `state` has a cyclomatic complexity of 8 293: function state(uint proposalId) public view returns (ProposalState) { ``` [293](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L293) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit function `state` has a cyclomatic complexity of 8 384: function state(uint proposalId) public view returns (ProposalState) { ``` [384](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L384)

### [N-29] Contract should expose an `interface` Exposing an interface in a smart contract allows for easier integration by other projects and developers. Without an interface, there's a risk that other projects will have to develop non-standard variants to interact with your contract. It's highly recommended to define an interface for clearer and more robust collaboration.

48 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 51: function initialize( address timelock_, address xvsVault_, uint votingPeriod_, uint votingDelay_, uint proposalThreshold_, address guardian_ ) public { 95: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { 172: function queue(uint proposalId) external { 191: function queueOrRevertInternal( address target, uint value, string memory signature, bytes memory data, uint eta ) internal { 210: function execute(uint proposalId) external { 233: function cancel(uint proposalId) external { 263: function getActions( uint proposalId ) external view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { 280: function getReceipt(uint proposalId, address voter) external view returns (Receipt memory) { 289: function state(uint proposalId) public view returns (ProposalState) { 319: function castVote(uint proposalId, uint8 support) external { 329: function castVoteWithReason(uint proposalId, uint8 support, string calldata reason) external { 337: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external { 355: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) { 382: function _setGuardian(address newGuardian) external { 395: function _setVotingDelay(uint newVotingDelay) external { 411: function _setVotingPeriod(uint newVotingPeriod) external { 428: function _setProposalThreshold(uint newProposalThreshold) external { 445: function _initiate(address governorAlpha) external { 458: function _setProposalMaxOperations(uint proposalMaxOperations_) external { 471: function _setPendingAdmin(address newPendingAdmin) external { 489: function _acceptAdmin() external { 509: function add256(uint256 a, uint256 b) internal pure returns (uint) { 515: function sub256(uint256 a, uint256 b) internal pure returns (uint) { 520: function getChainIdInternal() internal pure returns (uint) { ``` [51](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L51) | [95](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L95) | [172](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L172) | [191](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L191) | [210](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L210) | [233](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L233) | [263](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L263) | [280](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L280) | [289](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L289) | [319](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L319) | [329](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L329) | [337](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L337) | [355](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L355) | [382](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L382) | [395](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L395) | [411](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L411) | [428](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L428) | [445](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L445) | [458](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L458) | [471](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L471) | [489](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L489) | [509](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L509) | [515](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L515) | [520](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L520) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 111: function initialize( address xvsVault_, ProposalConfig[] memory proposalConfigs_, TimelockInterface[] memory timelocks, address guardian_ ) public { 181: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description, ProposalType proposalType ) public returns (uint) { 262: function queue(uint proposalId) external { 282: function queueOrRevertInternal( address target, uint value, string memory signature, bytes memory data, uint eta, uint8 proposalType ) internal { 304: function execute(uint proposalId) external { 327: function cancel(uint proposalId) external { 358: function getActions( uint proposalId ) external view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { 375: function getReceipt(uint proposalId, address voter) external view returns (Receipt memory) { 384: function state(uint proposalId) public view returns (ProposalState) { 416: function castVote(uint proposalId, uint8 support) external { 426: function castVoteWithReason(uint proposalId, uint8 support, string calldata reason) external { 439: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external { 457: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) { 484: function _setGuardian(address newGuardian) external { 498: function _initiate(address governorAlpha) external { 513: function _setProposalMaxOperations(uint proposalMaxOperations_) external { 526: function _setPendingAdmin(address newPendingAdmin) external { 544: function _acceptAdmin() external { 564: function add256(uint256 a, uint256 b) internal pure returns (uint) { 570: function sub256(uint256 a, uint256 b) internal pure returns (uint) { 575: function getChainIdInternal() internal pure returns (uint) { ``` [111](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L111) | [181](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L181) | [262](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L262) | [282](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L282) | [304](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L304) | [327](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L327) | [358](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L358) | [375](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L375) | [384](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L384) | [416](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L416) | [426](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L426) | [439](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L439) | [457](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L457) | [484](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L484) | [498](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L498) | [513](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L513) | [526](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L526) | [544](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L544) | [564](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L564) | [570](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L570) | [575](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L575) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 47: function _setImplementation(address implementation_) public { 66: function delegateTo(address callee, bytes memory data) internal { ``` [47](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L47) | [66](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L66) ```solidity File: contracts/Governance/AccessControlManager.sol 45: function setCollateralFactor(VToken vToken, uint256 newCollateralFactorMantissa, uint256 newLiquidationThresholdMantissa) external { ``` [45](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L45)

### [N-30] Critical system parameter changes should be behind a timelock It is a good practice to give time for users to react and adjust to critical changes. A timelock provides more guarantees and reduces the level of trust required, thus decreasing risk for users. It also indicates that the project is legitimate (less risk of a malicious owner making a sandwich attack on a user).

6 issue instances in 4 files:

```solidity File: contracts/Governance/AccessControlledV8.sol 48: function setAccessControlManager(address accessControlManager_) external onlyOwner { ``` [48](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L48) ```solidity File: contracts/Governance/Timelock.sol 86: function setDelay(uint delay_) public { 110: function setPendingAdmin(address pendingAdmin_) public { ``` [86](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L86) | [110](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L110) ```solidity File: contracts/Governance/AccessControlManager.sol 45: function setCollateralFactor(VToken vToken, uint256 newCollateralFactorMantissa, uint256 newLiquidationThresholdMantissa) external { ``` [45](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L45) ```solidity File: contracts/Governance/TimelockV8.sol 88: function setDelay(uint256 delay_) public { 124: function setPendingAdmin(address pendingAdmin_) public { ``` [88](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L88) | [124](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L124)

### [N-31] Outdated Solidity Version The current Solidity version used in the contract is outdated. Consider using a more recent version for improved features and security. 0.8.4: bytes.concat() instead of abi.encodePacked(,) 0.8.12: string.concat() instead of abi.encodePacked(,) 0.8.13: Ability to use using for with a list of free functions 0.8.14: ABI Encoder: When ABI-encoding values from calldata that contain nested arrays, correctly validate the nested array length against calldatasize() in all cases. Override Checker: Allow changing data location for parameters only when overriding external functions. 0.8.15: Code Generation: Avoid writing dirty bytes to storage when copying bytes arrays. Yul Optimizer: Keep all memory side-effects of inline assembly blocks. 0.8.16: Code Generation: Fix data corruption that affected ABI-encoding of calldata values represented by tuples: structs at any nesting level; argument lists of external functions, events and errors; return value lists of external functions. The 32 leading bytes of the first dynamically-encoded value in the tuple would get zeroed when the last component contained a statically-encoded array. 0.8.17: Yul Optimizer: Prevent the incorrect removal of storage writes before calls to Yul functions that conditionally terminate the external EVM call.

14 issue instances in 14 files:

### [N-32] Ensure Non-Empty Check for Bytes in Function Parameters To avoid mistakenly accepting empty bytes as valid parameters, it is advisable to implement checks for non-empty bytes within functions. This ensures that empty bytes are not treated as valid inputs, preventing potential issues.

29 issue instances in 8 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 318: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public { 318: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public { 396: function queuedTransactions(bytes32 hash) external view returns (bool); 398: function queueTransaction( address target, uint value, string calldata signature, bytes calldata data, uint eta ) external returns (bytes32); 406: function cancelTransaction( address target, uint value, string calldata signature, bytes calldata data, uint eta ) external; 414: function executeTransaction( address target, uint value, string calldata signature, bytes calldata data, uint eta ) external payable returns (bytes memory); ``` [318](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L318) | [318](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L318) | [396](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L396) | [398](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L398) | [406](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L406) | [414](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L414) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 337: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external { 337: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external { ``` [337](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L337) | [337](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L337) ```solidity File: contracts/legacy/GovernorAlpha2.sol 319: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public { 319: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public { 397: function queuedTransactions(bytes32 hash) external view returns (bool); 399: function queueTransaction( address target, uint value, string calldata signature, bytes calldata data, uint eta ) external returns (bytes32); 407: function cancelTransaction( address target, uint value, string calldata signature, bytes calldata data, uint eta ) external; 415: function executeTransaction( address target, uint value, string calldata signature, bytes calldata data, uint eta ) external payable returns (bytes memory); ``` [319](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L319) | [319](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L319) | [397](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L397) | [399](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L399) | [407](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L407) | [415](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L415) ```solidity File: contracts/Governance/Timelock.sol 126: function queueTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public returns (bytes32) { 154: function cancelTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public { ``` [126](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L126) | [154](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L154) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 220: function queuedTransactions(bytes32 hash) external view returns (bool); 222: function queueTransaction( address target, uint value, string calldata signature, bytes calldata data, uint eta ) external returns (bytes32); 230: function cancelTransaction( address target, uint value, string calldata signature, bytes calldata data, uint eta ) external; 238: function executeTransaction( address target, uint value, string calldata signature, bytes calldata data, uint eta ) external payable returns (bytes memory); ``` [220](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L220) | [222](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L222) | [230](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L230) | [238](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L238) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 439: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external { 439: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external { ``` [439](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L439) | [439](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L439) ```solidity File: contracts/Governance/TimelockV8.sol 141: function queueTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public returns (bytes32) { 169: function cancelTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public { ``` [141](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L141) | [169](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L169) ```solidity File: contracts/Governance/IAccessControlManagerV5.sol 39: function hasRole(bytes32 role, address account) external view returns (bool); 47: function getRoleAdmin(bytes32 role) external view returns (bytes32); 59: function grantRole(bytes32 role, address account) external; 70: function revokeRole(bytes32 role, address account) external; 86: function renounceRole(bytes32 role, address account) external; ``` [39](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV5.sol#L39) | [47](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV5.sol#L47) | [59](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV5.sol#L59) | [70](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV5.sol#L70) | [86](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV5.sol#L86)

### [N-33] Assembly blocks should have extensive comments Large assembly blocks require extensive comments to aid understanding and code auditing. Assembly code takes more time to audit than normal Solidity code and often contains intricate details that aren't as apparent as in higher-level languages. The identified assembly blocks in your contract appear to lack sufficient comments. Consider adding more comments explaining what each step of the assembly code does.

6 issue instances in 5 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 383: assembly { chainId := chainid() } ``` [383](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L383) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 523: assembly { chainId := chainid() } ``` [523](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L523) ```solidity File: contracts/legacy/GovernorAlpha2.sol 384: assembly { chainId := chainid() } ``` [384](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L384) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 578: assembly { chainId := chainid() } ``` [578](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L578) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 68: assembly { if eq(success, 0) { revert(add(returnData, 0x20), returndatasize) } 83: assembly { let free_mem_ptr := mload(0x40) returndatacopy(free_mem_ptr, 0, returndatasize) switch success case 0 { revert(free_mem_ptr, returndatasize) } ``` [68](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L68) | [83](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L83)

### [N-34] State-Altering Functions Should Emit Events Functions that alter state should emit events to inform users of the state change. This is crucial for functions that modify the state and don't return a value. The absence of events in such scenarios could lead to lack of transparency and traceability, undermining the contract's reliability.

2 issue instances in 2 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 357: guardian = address(0); ``` [357](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L357) ```solidity File: contracts/legacy/GovernorAlpha2.sol 358: guardian = address(0); ``` [358](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L358)

### [N-35] Upgrade `openzeppelin` to the Latest Version - 5.0.0 These contracts import contracts from @openzeppelin/contracts but they are not using the latest version. For more information, please visit: [OpenZeppelin GitHub Releases](https://github.com/OpenZeppelin/openzeppelin-contracts/releases) It is recommended to always use the latest version to take advantage of updates and security fixes.

4 issue instances in 3 files:

```solidity File: contracts/Governance/IAccessControlManagerV8.sol 4: import "@openzeppelin/contracts/access/IAccessControl.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV8.sol#L4) ```solidity File: contracts/Governance/AccessControlledV8.sol 4: import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol"; 5: import "@openzeppelin/contracts-upgradeable/access/Ownable2StepUpgradeable.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L4) | [5](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L5) ```solidity File: contracts/Governance/AccessControlManager.sol 3: import "@openzeppelin/contracts/access/AccessControl.sol"; ``` [3](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L3)

### [N-36] Interface Names Should Begin with a Capital `I` It is a common practice in Solidity programming to prefix the names of interfaces with a capital 'I'. This helps to clearly distinguish interfaces from other types of contracts, such as ordinary contracts or libraries, enhancing the readability and maintainability of the code.

7 issue instances in 3 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 390: interface TimelockInterface { 424: interface XVSInterface { ``` [390](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L390) | [424](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L424) ```solidity File: contracts/legacy/GovernorAlpha2.sol 391: interface TimelockInterface { 425: interface XVSInterface { ``` [391](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L391) | [425](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L425) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 214: interface TimelockInterface { 248: interface XvsVaultInterface { 252: interface GovernorAlphaInterface { ``` [214](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L214) | [248](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L248) | [252](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L252)

### [N-37] Duplicated `require()`/`revert()` checks should be refactored to a modifier or function Duplicated require() or revert() checks should be refactored to a modifier or function. This helps in maintaining a clean and organized codebase and saves deployment costs.

4 issue instances in 2 files:

```solidity File: contracts/Governance/Timelock.sol 74: require(delay_ <= MAXIMUM_DELAY, "Timelock::setDelay: Delay must not exceed maximum delay."); 89: require(delay_ <= MAXIMUM_DELAY, "Timelock::setDelay: Delay must not exceed maximum delay."); ``` [74](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L74) | [89](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L89) ```solidity File: contracts/Governance/TimelockV8.sol 75: require(delay_ <= MAXIMUM_DELAY(), "Timelock::setDelay: Delay must not exceed maximum delay."); 91: require(delay_ <= MAXIMUM_DELAY(), "Timelock::setDelay: Delay must not exceed maximum delay."); ``` [75](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L75) | [91](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L91)

### [N-38] Non-specific Imports The current form of relative path import is not recommended for use because it can unpredictably pollute the namespace. Instead, the Solidity docs recommend specifying imported symbols explicitly. https://docs.soliditylang.org/en/v0.8.15/layout-of-source-files.html#importing-other-source-files Example: import {OwnableUpgradeable} from "openzeppelin-contracts-upgradeable/contracts/access/OwnableUpgradeable.sol"; import {SafeTransferLib} from "solmate/utils/SafeTransferLib.sol";

11 issue instances in 8 files:

```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 4: import "./GovernorBravoInterfaces.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L4) ```solidity File: contracts/Governance/IAccessControlManagerV8.sol 4: import "@openzeppelin/contracts/access/IAccessControl.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV8.sol#L4) ```solidity File: contracts/Governance/AccessControlledV8.sol 4: import "@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol"; 5: import "@openzeppelin/contracts-upgradeable/access/Ownable2StepUpgradeable.sol"; 7: import "./IAccessControlManagerV8.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L4) | [5](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L5) | [7](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L7) ```solidity File: contracts/Governance/Timelock.sol 3: import "../Utils/SafeMath.sol"; ``` [3](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L3) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 4: import "./GovernorBravoInterfaces.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L4) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 4: import "./GovernorBravoInterfaces.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L4) ```solidity File: contracts/Governance/AccessControlManager.sol 3: import "@openzeppelin/contracts/access/AccessControl.sol"; 4: import "./IAccessControlManagerV8.sol"; ``` [3](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L3) | [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L4) ```solidity File: contracts/Governance/AccessControlledV5.sol 4: import "./IAccessControlManagerV5.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV5.sol#L4)

### [N-39] Event is not properly `indexed` Index event fields make the field more quickly accessible to off-chain tools that parse events. This is especially useful when it comes to filtering based on an address. However, note that each index field costs extra gas during emission, so it's not necessarily best to index the maximum allowed per event (three fields). Where applicable, each event should use three indexed fields if there are three or more fields, and gas usage is not particularly of concern for the events in question. If there are fewer than three applicable fields, all of the applicable fields should be indexed.

46 issue instances in 9 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 112: event ProposalCreated( uint id, address proposer, address[] targets, uint[] values, string[] signatures, bytes[] calldatas, uint startBlock, uint endBlock, string description ); 125: event VoteCast(address voter, uint proposalId, bool support, uint votes); 128: event ProposalCanceled(uint id); 131: event ProposalQueued(uint id, uint eta); 134: event ProposalExecuted(uint id); ``` [112](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L112) | [125](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L125) | [128](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L128) | [131](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L131) | [134](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L134) ```solidity File: contracts/legacy/GovernorBravoInterfaces.sol 14: event ProposalCreated( uint id, address proposer, address[] targets, uint[] values, string[] signatures, bytes[] calldatas, uint startBlock, uint endBlock, string description ); 32: event VoteCast(address indexed voter, uint proposalId, uint8 support, uint votes, string reason); 35: event ProposalCanceled(uint id); 38: event ProposalQueued(uint id, uint eta); 41: event ProposalExecuted(uint id); 44: event VotingDelaySet(uint oldVotingDelay, uint newVotingDelay); 47: event VotingPeriodSet(uint oldVotingPeriod, uint newVotingPeriod); 50: event NewImplementation(address oldImplementation, address newImplementation); 53: event ProposalThresholdSet(uint oldProposalThreshold, uint newProposalThreshold); 56: event NewPendingAdmin(address oldPendingAdmin, address newPendingAdmin); 59: event NewAdmin(address oldAdmin, address newAdmin); 62: event NewGuardian(address oldGuardian, address newGuardian); 65: event ProposalMaxOperationsUpdated(uint oldMaxOperations, uint newMaxOperations); ``` [14](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L14) | [32](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L32) | [35](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L35) | [38](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L38) | [41](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L41) | [44](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L44) | [47](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L47) | [50](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L50) | [53](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L53) | [56](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L56) | [59](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L59) | [62](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L62) | [65](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L65) ```solidity File: contracts/legacy/GovernorAlpha2.sol 112: event ProposalCreated( uint id, address proposer, address[] targets, uint[] values, string[] signatures, bytes[] calldatas, uint startBlock, uint endBlock, string description ); 125: event VoteCast(address voter, uint proposalId, bool support, uint votes); 128: event ProposalCanceled(uint id); 131: event ProposalQueued(uint id, uint eta); 134: event ProposalExecuted(uint id); ``` [112](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L112) | [125](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L125) | [128](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L128) | [131](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L131) | [134](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L134) ```solidity File: contracts/Governance/AccessControlledV8.sol 27: event NewAccessControlManager(address oldAccessControlManager, address newAccessControlManager); ``` [27](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L27) ```solidity File: contracts/Governance/Timelock.sol 22: event CancelTransaction( bytes32 indexed txHash, address indexed target, uint value, string signature, bytes data, uint eta ); 32: event ExecuteTransaction( bytes32 indexed txHash, address indexed target, uint value, string signature, bytes data, uint eta ); 42: event QueueTransaction( bytes32 indexed txHash, address indexed target, uint value, string signature, bytes data, uint eta ); ``` [22](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L22) | [32](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L32) | [42](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L42) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 11: event ProposalCreated( uint id, address proposer, address[] targets, uint[] values, string[] signatures, bytes[] calldatas, uint startBlock, uint endBlock, string description, uint8 proposalType ); 30: event VoteCast(address indexed voter, uint proposalId, uint8 support, uint votes, string reason); 33: event ProposalCanceled(uint id); 36: event ProposalQueued(uint id, uint eta); 39: event ProposalExecuted(uint id); 42: event VotingDelaySet(uint oldVotingDelay, uint newVotingDelay); 45: event VotingPeriodSet(uint oldVotingPeriod, uint newVotingPeriod); 48: event NewImplementation(address oldImplementation, address newImplementation); 51: event ProposalThresholdSet(uint oldProposalThreshold, uint newProposalThreshold); 54: event NewPendingAdmin(address oldPendingAdmin, address newPendingAdmin); 57: event NewAdmin(address oldAdmin, address newAdmin); 60: event NewGuardian(address oldGuardian, address newGuardian); 63: event ProposalMaxOperationsUpdated(uint oldMaxOperations, uint newMaxOperations); ``` [11](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L11) | [30](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L30) | [33](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L33) | [36](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L36) | [39](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L39) | [42](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L42) | [45](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L45) | [48](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L48) | [51](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L51) | [54](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L54) | [57](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L57) | [60](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L60) | [63](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L63) ```solidity File: contracts/Governance/AccessControlManager.sol 56: event PermissionGranted(address account, address contractAddress, string functionSig); 59: event PermissionRevoked(address account, address contractAddress, string functionSig); ``` [56](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L56) | [59](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L59) ```solidity File: contracts/Governance/TimelockV8.sol 23: event CancelTransaction( bytes32 indexed txHash, address indexed target, uint256 value, string signature, bytes data, uint256 eta ); 33: event ExecuteTransaction( bytes32 indexed txHash, address indexed target, uint256 value, string signature, bytes data, uint256 eta ); 43: event QueueTransaction( bytes32 indexed txHash, address indexed target, uint256 value, string signature, bytes data, uint256 eta ); ``` [23](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L23) | [33](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L33) | [43](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L43) ```solidity File: contracts/Governance/AccessControlledV5.sol 24: event NewAccessControlManager(address oldAccessControlManager, address newAccessControlManager); ``` [24](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV5.sol#L24)

### [N-40] Consider Adding Emergency-Stop Functionality Smart contracts that hold significant value, interact with external contracts, or have complex logic should include an emergency-stop mechanism for added security. This allows pausing certain contract functionalities in case of emergencies, mitigating potential damages. This contract seems to lack such a mechanism. Implementing an emergency stop can enhance contract security and reliability.

11 issue instances in 11 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L1) ```solidity File: contracts/legacy/GovernorBravoInterfaces.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L1) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L1) ```solidity File: contracts/legacy/GovernorAlpha2.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L1) ```solidity File: contracts/Governance/Timelock.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L1) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L1) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L1) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L1) ```solidity File: contracts/Governance/AccessControlManager.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L1) ```solidity File: contracts/Governance/TimelockV8.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L1) ```solidity File: contracts/Governance/AccessControlledV5.sol 1: No emergency stop pattern found ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV5.sol#L1)

### [N-41] `constant` variables not using all capital letters Variable names for `constant` variables should consist of all capital letters.

6 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 6: string public constant name = "Venus Governor Alpha"; ``` [6](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L6) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 13: string public constant name = "Venus Governor Bravo"; 34: uint public constant quorumVotes = 600000e18; // 600,000 = 2% of Xvs ``` [13](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L13) | [34](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L34) ```solidity File: contracts/legacy/GovernorAlpha2.sol 6: string public constant name = "Venus Governor Alpha"; ``` [6](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L6) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 75: string public constant name = "Venus Governor Bravo"; 96: uint public constant quorumVotes = 600000e18; // 600,000 = 2% of Xvs ``` [75](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L75) | [96](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L96)

### [N-42] Not using the named return variables anywhere in the function is confusing Declaring a named return variable but returning a different value within the function is an inconsistent use of named return variables. This practice can lead to confusion and misinterpretation of the function's intended behavior, as it contradicts the purpose of declaring named return variables, which is to enhance readability and reduce complexity in the code. This inconsistency might signal an error in the function logic where the declared return variable is not being used as intended. It is recommended to revisit the function's logic to ensure that the named return variables are being utilized correctly, or to adjust the return statements to reflect the actual values being returned, fostering better clarity and coherence in the code.

4 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit - `return (p.targets, p.values, p.signatures, p.calldatas);` statement in functions but `targets, values, signatures, calldatas` are declared 277: function getActions( uint proposalId ) public view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { ``` [277](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L277) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit - `return (p.targets, p.values, p.signatures, p.calldatas);` statement in functions but `targets, values, signatures, calldatas` are declared 263: function getActions( uint proposalId ) external view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { ``` [263](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L263) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit - `return (p.targets, p.values, p.signatures, p.calldatas);` statement in functions but `targets, values, signatures, calldatas` are declared 278: function getActions( uint proposalId ) public view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { ``` [278](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L278) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit - `return (p.targets, p.values, p.signatures, p.calldatas);` statement in functions but `targets, values, signatures, calldatas` are declared 358: function getActions( uint proposalId ) external view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { ``` [358](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L358)

### [N-43] Function Names Not in mixedCase Function names should use mixedCase for better readability and consistency with Solidity style guidelines. Examples of good practice include: getBalance, transfer, verifyOwner, addMember, changeOwner. [More information in Documentation](https://docs.soliditylang.org/en/v0.8.20/style-guide.html#function-names)

16 issue instances in 5 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 349: function __acceptAdmin() public { 354: function __abdicate() public { 359: function __queueSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { 364: function __executeSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { 392: function GRACE_PERIOD() external view returns (uint); ``` [349](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L349) | [354](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L354) | [359](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L359) | [364](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L364) | [392](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L392) ```solidity File: contracts/legacy/GovernorAlpha2.sol 350: function __acceptAdmin() public { 355: function __abdicate() public { 360: function __queueSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { 365: function __executeSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { 393: function GRACE_PERIOD() external view returns (uint); ``` [350](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L350) | [355](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L355) | [360](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L360) | [365](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L365) | [393](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L393) ```solidity File: contracts/Governance/AccessControlledV8.sol 31: function __AccessControlled_init(address accessControlManager_) internal onlyInitializing { 36: function __AccessControlled_init_unchained(address accessControlManager_) internal onlyInitializing { ``` [31](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L31) | [36](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L36) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 216: function GRACE_PERIOD() external view returns (uint); ``` [216](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L216) ```solidity File: contracts/Governance/TimelockV8.sol 96: function GRACE_PERIOD() public view virtual returns (uint256) { 100: function MINIMUM_DELAY() public view virtual returns (uint256) { 104: function MAXIMUM_DELAY() public view virtual returns (uint256) { ``` [96](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L96) | [100](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L100) | [104](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L104)

### [N-44] Insufficient Comments in Complex Functions Complex functions spanning multiple lines should have more comments to better explain the purpose of each logic step. Proper commenting can greatly improve the readability and maintainability of the codebase. Consider adding explicit comments to provide insights into the function's operation.

5 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit function with 56 lines has only 0 comment lines 141: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { ``` [141](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L141) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit function with 58 lines has only 1 comment lines 95: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { ``` [95](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L95) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit function with 56 lines has only 0 comment lines 142: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { ``` [142](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L142) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit function with 45 lines has only 1 comment lines 111: function initialize( address xvsVault_, ProposalConfig[] memory proposalConfigs_, TimelockInterface[] memory timelocks, address guardian_ ) public { /// @audit function with 61 lines has only 1 comment lines 181: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description, ProposalType proposalType ) public returns (uint) { ``` [111](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L111) | [181](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L181)

### [N-45] Common functions should be refactored to a common base contract The codebase contains several functions with the same implementations across multiple files. To enhance maintainability and reduce potential errors, consider refactoring these common functions into a shared base contract. This practice promotes code reuse and easier future upgrades.

80 issue instances in 8 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 9: function quorumVotes() public pure returns (uint) { return 600000e18; } 14: function proposalThreshold() public pure returns (uint) { return 300000e18; } 24: function votingDelay() public pure returns (uint) { return 1; } 29: function votingPeriod() public pure returns (uint) { return (60 * 60 * 24 * 3) / 3; } 141: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { require( xvs.getPriorVotes(msg.sender, sub256(block.number, 1)) > proposalThreshold(), "GovernorAlpha::propose: proposer votes below proposal threshold" ); require( targets.length == values.length && targets.length == signatures.length && targets.length == calldatas.length, "GovernorAlpha::propose: proposal function information arity mismatch" ); require(targets.length != 0, "GovernorAlpha::propose: must provide actions"); require(targets.length <= proposalMaxOperations(), "GovernorAlpha::propose: too many actions"); uint latestProposalId = latestProposalIds[msg.sender]; if (latestProposalId != 0) { ProposalState proposersLatestProposalState = state(latestProposalId); require( proposersLatestProposalState != ProposalState.Active, "GovernorAlpha::propose: found an already active proposal" ); require( proposersLatestProposalState != ProposalState.Pending, "GovernorAlpha::propose: found an already pending proposal" ); } uint startBlock = add256(block.number, votingDelay()); uint endBlock = add256(startBlock, votingPeriod()); proposalCount++; Proposal memory newProposal = Proposal({ id: proposalCount, proposer: msg.sender, eta: 0, targets: targets, values: values, signatures: signatures, calldatas: calldatas, startBlock: startBlock, endBlock: endBlock, forVotes: 0, againstVotes: 0, canceled: false, executed: false }); proposals[newProposal.id] = newProposal; latestProposalIds[newProposal.proposer] = newProposal.id; emit ProposalCreated( newProposal.id, msg.sender, targets, values, signatures, calldatas, startBlock, endBlock, description ); return newProposal.id; } 211: function queue(uint proposalId) public { require( state(proposalId) == ProposalState.Succeeded, "GovernorAlpha::queue: proposal can only be queued if it is succeeded" ); Proposal storage proposal = proposals[proposalId]; uint eta = add256(block.timestamp, timelock.delay()); for (uint i = 0; i < proposal.targets.length; i++) { _queueOrRevert(proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], eta); } proposal.eta = eta; emit ProposalQueued(proposalId, eta); } 225: function _queueOrRevert(address target, uint value, string memory signature, bytes memory data, uint eta) internal { require( !timelock.queuedTransactions(keccak256(abi.encode(target, value, signature, data, eta))), "GovernorAlpha::_queueOrRevert: proposal action already queued at eta" ); timelock.queueTransaction(target, value, signature, data, eta); } 233: function execute(uint proposalId) public payable { require( state(proposalId) == ProposalState.Queued, "GovernorAlpha::execute: proposal can only be executed if it is queued" ); Proposal storage proposal = proposals[proposalId]; proposal.executed = true; for (uint i = 0; i < proposal.targets.length; i++) { timelock.executeTransaction.value(proposal.values[i])( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], proposal.eta ); } emit ProposalExecuted(proposalId); } 252: function cancel(uint proposalId) public { ProposalState state = state(proposalId); require(state != ProposalState.Executed, "GovernorAlpha::cancel: cannot cancel executed proposal"); Proposal storage proposal = proposals[proposalId]; require( msg.sender == guardian || xvs.getPriorVotes(proposal.proposer, sub256(block.number, 1)) < proposalThreshold(), "GovernorAlpha::cancel: proposer above threshold" ); proposal.canceled = true; for (uint i = 0; i < proposal.targets.length; i++) { timelock.cancelTransaction( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], proposal.eta ); } emit ProposalCanceled(proposalId); } 277: function getActions( uint proposalId ) public view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { Proposal storage p = proposals[proposalId]; return (p.targets, p.values, p.signatures, p.calldatas); } 288: function getReceipt(uint proposalId, address voter) public view returns (Receipt memory) { return proposals[proposalId].receipts[voter]; } 292: function state(uint proposalId) public view returns (ProposalState) { require(proposalCount >= proposalId && proposalId > 0, "GovernorAlpha::state: invalid proposal id"); Proposal storage proposal = proposals[proposalId]; if (proposal.canceled) { return ProposalState.Canceled; } else if (block.number <= proposal.startBlock) { return ProposalState.Pending; } else if (block.number <= proposal.endBlock) { return ProposalState.Active; } else if (proposal.forVotes <= proposal.againstVotes || proposal.forVotes < quorumVotes()) { return ProposalState.Defeated; } else if (proposal.eta == 0) { return ProposalState.Succeeded; } else if (proposal.executed) { return ProposalState.Executed; } else if (block.timestamp >= add256(proposal.eta, timelock.GRACE_PERIOD())) { return ProposalState.Expired; } else { return ProposalState.Queued; } } 314: function castVote(uint proposalId, bool support) public { return _castVote(msg.sender, proposalId, support); } 318: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public { bytes32 domainSeparator = keccak256( abi.encode(DOMAIN_TYPEHASH, keccak256(bytes(name)), getChainId(), address(this)) ); bytes32 structHash = keccak256(abi.encode(BALLOT_TYPEHASH, proposalId, support)); bytes32 digest = keccak256(abi.encodePacked("\x19\x01", domainSeparator, structHash)); address signatory = ecrecover(digest, v, r, s); require(signatory != address(0), "GovernorAlpha::castVoteBySig: invalid signature"); return _castVote(signatory, proposalId, support); } 329: function _castVote(address voter, uint proposalId, bool support) internal { require(state(proposalId) == ProposalState.Active, "GovernorAlpha::_castVote: voting is closed"); Proposal storage proposal = proposals[proposalId]; Receipt storage receipt = proposal.receipts[voter]; require(receipt.hasVoted == false, "GovernorAlpha::_castVote: voter already voted"); uint96 votes = xvs.getPriorVotes(voter, proposal.startBlock); if (support) { proposal.forVotes = add256(proposal.forVotes, votes); } else { proposal.againstVotes = add256(proposal.againstVotes, votes); } receipt.hasVoted = true; receipt.support = support; receipt.votes = votes; emit VoteCast(voter, proposalId, support, votes); } 349: function __acceptAdmin() public { require(msg.sender == guardian, "GovernorAlpha::__acceptAdmin: sender must be gov guardian"); timelock.acceptAdmin(); } 354: function __abdicate() public { require(msg.sender == guardian, "GovernorAlpha::__abdicate: sender must be gov guardian"); guardian = address(0); } 359: function __queueSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { require(msg.sender == guardian, "GovernorAlpha::__queueSetTimelockPendingAdmin: sender must be gov guardian"); timelock.queueTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta); } 364: function __executeSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { require(msg.sender == guardian, "GovernorAlpha::__executeSetTimelockPendingAdmin: sender must be gov guardian"); timelock.executeTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta); } 369: function add256(uint256 a, uint256 b) internal pure returns (uint) { uint c = a + b; require(c >= a, "addition overflow"); return c; } 375: function sub256(uint256 a, uint256 b) internal pure returns (uint) { require(b <= a, "subtraction underflow"); return a - b; } 380: function getChainId() internal pure returns (uint) { uint chainId; assembly { chainId := chainid() } return chainId; } ``` [9](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L9) | [14](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L14) | [24](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L24) | [29](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L29) | [141](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L141) | [211](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L211) | [225](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L225) | [233](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L233) | [252](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L252) | [277](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L277) | [288](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L288) | [292](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L292) | [314](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L314) | [318](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L318) | [329](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L329) | [349](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L349) | [354](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L354) | [359](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L359) | [364](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L364) | [369](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L369) | [375](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L375) | [380](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L380) ```solidity File: contracts/legacy/GovernorAlpha2.sol 9: function quorumVotes() public pure returns (uint) { return 600000e18; } 14: function proposalThreshold() public pure returns (uint) { return 300000e18; } 24: function votingDelay() public pure returns (uint) { return 1; } 29: function votingPeriod() public pure returns (uint) { return (60 * 60 * 24 * 3) / 3; } 142: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { require( xvs.getPriorVotes(msg.sender, sub256(block.number, 1)) > proposalThreshold(), "GovernorAlpha::propose: proposer votes below proposal threshold" ); require( targets.length == values.length && targets.length == signatures.length && targets.length == calldatas.length, "GovernorAlpha::propose: proposal function information arity mismatch" ); require(targets.length != 0, "GovernorAlpha::propose: must provide actions"); require(targets.length <= proposalMaxOperations(), "GovernorAlpha::propose: too many actions"); uint latestProposalId = latestProposalIds[msg.sender]; if (latestProposalId != 0) { ProposalState proposersLatestProposalState = state(latestProposalId); require( proposersLatestProposalState != ProposalState.Active, "GovernorAlpha::propose: found an already active proposal" ); require( proposersLatestProposalState != ProposalState.Pending, "GovernorAlpha::propose: found an already pending proposal" ); } uint startBlock = add256(block.number, votingDelay()); uint endBlock = add256(startBlock, votingPeriod()); proposalCount++; Proposal memory newProposal = Proposal({ id: proposalCount, proposer: msg.sender, eta: 0, targets: targets, values: values, signatures: signatures, calldatas: calldatas, startBlock: startBlock, endBlock: endBlock, forVotes: 0, againstVotes: 0, canceled: false, executed: false }); proposals[newProposal.id] = newProposal; latestProposalIds[newProposal.proposer] = newProposal.id; emit ProposalCreated( newProposal.id, msg.sender, targets, values, signatures, calldatas, startBlock, endBlock, description ); return newProposal.id; } 212: function queue(uint proposalId) public { require( state(proposalId) == ProposalState.Succeeded, "GovernorAlpha::queue: proposal can only be queued if it is succeeded" ); Proposal storage proposal = proposals[proposalId]; uint eta = add256(block.timestamp, timelock.delay()); for (uint i = 0; i < proposal.targets.length; i++) { _queueOrRevert(proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], eta); } proposal.eta = eta; emit ProposalQueued(proposalId, eta); } 226: function _queueOrRevert(address target, uint value, string memory signature, bytes memory data, uint eta) internal { require( !timelock.queuedTransactions(keccak256(abi.encode(target, value, signature, data, eta))), "GovernorAlpha::_queueOrRevert: proposal action already queued at eta" ); timelock.queueTransaction(target, value, signature, data, eta); } 234: function execute(uint proposalId) public payable { require( state(proposalId) == ProposalState.Queued, "GovernorAlpha::execute: proposal can only be executed if it is queued" ); Proposal storage proposal = proposals[proposalId]; proposal.executed = true; for (uint i = 0; i < proposal.targets.length; i++) { timelock.executeTransaction.value(proposal.values[i])( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], proposal.eta ); } emit ProposalExecuted(proposalId); } 253: function cancel(uint proposalId) public { ProposalState state = state(proposalId); require(state != ProposalState.Executed, "GovernorAlpha::cancel: cannot cancel executed proposal"); Proposal storage proposal = proposals[proposalId]; require( msg.sender == guardian || xvs.getPriorVotes(proposal.proposer, sub256(block.number, 1)) < proposalThreshold(), "GovernorAlpha::cancel: proposer above threshold" ); proposal.canceled = true; for (uint i = 0; i < proposal.targets.length; i++) { timelock.cancelTransaction( proposal.targets[i], proposal.values[i], proposal.signatures[i], proposal.calldatas[i], proposal.eta ); } emit ProposalCanceled(proposalId); } 278: function getActions( uint proposalId ) public view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { Proposal storage p = proposals[proposalId]; return (p.targets, p.values, p.signatures, p.calldatas); } 289: function getReceipt(uint proposalId, address voter) public view returns (Receipt memory) { return proposals[proposalId].receipts[voter]; } 293: function state(uint proposalId) public view returns (ProposalState) { require(proposalCount >= proposalId && proposalId > 0, "GovernorAlpha::state: invalid proposal id"); Proposal storage proposal = proposals[proposalId]; if (proposal.canceled) { return ProposalState.Canceled; } else if (block.number <= proposal.startBlock) { return ProposalState.Pending; } else if (block.number <= proposal.endBlock) { return ProposalState.Active; } else if (proposal.forVotes <= proposal.againstVotes || proposal.forVotes < quorumVotes()) { return ProposalState.Defeated; } else if (proposal.eta == 0) { return ProposalState.Succeeded; } else if (proposal.executed) { return ProposalState.Executed; } else if (block.timestamp >= add256(proposal.eta, timelock.GRACE_PERIOD())) { return ProposalState.Expired; } else { return ProposalState.Queued; } } 315: function castVote(uint proposalId, bool support) public { return _castVote(msg.sender, proposalId, support); } 319: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public { bytes32 domainSeparator = keccak256( abi.encode(DOMAIN_TYPEHASH, keccak256(bytes(name)), getChainId(), address(this)) ); bytes32 structHash = keccak256(abi.encode(BALLOT_TYPEHASH, proposalId, support)); bytes32 digest = keccak256(abi.encodePacked("\x19\x01", domainSeparator, structHash)); address signatory = ecrecover(digest, v, r, s); require(signatory != address(0), "GovernorAlpha::castVoteBySig: invalid signature"); return _castVote(signatory, proposalId, support); } 330: function _castVote(address voter, uint proposalId, bool support) internal { require(state(proposalId) == ProposalState.Active, "GovernorAlpha::_castVote: voting is closed"); Proposal storage proposal = proposals[proposalId]; Receipt storage receipt = proposal.receipts[voter]; require(receipt.hasVoted == false, "GovernorAlpha::_castVote: voter already voted"); uint96 votes = xvs.getPriorVotes(voter, proposal.startBlock); if (support) { proposal.forVotes = add256(proposal.forVotes, votes); } else { proposal.againstVotes = add256(proposal.againstVotes, votes); } receipt.hasVoted = true; receipt.support = support; receipt.votes = votes; emit VoteCast(voter, proposalId, support, votes); } 350: function __acceptAdmin() public { require(msg.sender == guardian, "GovernorAlpha::__acceptAdmin: sender must be gov guardian"); timelock.acceptAdmin(); } 355: function __abdicate() public { require(msg.sender == guardian, "GovernorAlpha::__abdicate: sender must be gov guardian"); guardian = address(0); } 360: function __queueSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { require(msg.sender == guardian, "GovernorAlpha::__queueSetTimelockPendingAdmin: sender must be gov guardian"); timelock.queueTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta); } 365: function __executeSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { require(msg.sender == guardian, "GovernorAlpha::__executeSetTimelockPendingAdmin: sender must be gov guardian"); timelock.executeTransaction(address(timelock), 0, "setPendingAdmin(address)", abi.encode(newPendingAdmin), eta); } 370: function add256(uint256 a, uint256 b) internal pure returns (uint) { uint c = a + b; require(c >= a, "addition overflow"); return c; } 376: function sub256(uint256 a, uint256 b) internal pure returns (uint) { require(b <= a, "subtraction underflow"); return a - b; } 381: function getChainId() internal pure returns (uint) { uint chainId; assembly { chainId := chainid() } return chainId; } ``` [9](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L9) | [14](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L14) | [24](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L24) | [29](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L29) | [142](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L142) | [212](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L212) | [226](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L226) | [234](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L234) | [253](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L253) | [278](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L278) | [289](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L289) | [293](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L293) | [315](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L315) | [319](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L319) | [330](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L330) | [350](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L350) | [355](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L355) | [360](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L360) | [365](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L365) | [370](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L370) | [376](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L376) | [381](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L381) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 263: function getActions( uint proposalId ) external view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { Proposal storage p = proposals[proposalId]; return (p.targets, p.values, p.signatures, p.calldatas); } 280: function getReceipt(uint proposalId, address voter) external view returns (Receipt memory) { return proposals[proposalId].receipts[voter]; } 509: function add256(uint256 a, uint256 b) internal pure returns (uint) { uint c = a + b; require(c >= a, "addition overflow"); return c; } 515: function sub256(uint256 a, uint256 b) internal pure returns (uint) { require(b <= a, "subtraction underflow"); return a - b; } 520: function getChainIdInternal() internal pure returns (uint) { uint chainId; assembly { chainId := chainid() } return chainId; } 319: function castVote(uint proposalId, uint8 support) external { emit VoteCast(msg.sender, proposalId, support, castVoteInternal(msg.sender, proposalId, support), ""); } 329: function castVoteWithReason(uint proposalId, uint8 support, string calldata reason) external { emit VoteCast(msg.sender, proposalId, support, castVoteInternal(msg.sender, proposalId, support), reason); } 337: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external { bytes32 domainSeparator = keccak256( abi.encode(DOMAIN_TYPEHASH, keccak256(bytes(name)), getChainIdInternal(), address(this)) ); bytes32 structHash = keccak256(abi.encode(BALLOT_TYPEHASH, proposalId, support)); bytes32 digest = keccak256(abi.encodePacked("\x19\x01", domainSeparator, structHash)); address signatory = ecrecover(digest, v, r, s); require(signatory != address(0), "GovernorBravo::castVoteBySig: invalid signature"); emit VoteCast(signatory, proposalId, support, castVoteInternal(signatory, proposalId, support), ""); } 355: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) { require(state(proposalId) == ProposalState.Active, "GovernorBravo::castVoteInternal: voting is closed"); require(support <= 2, "GovernorBravo::castVoteInternal: invalid vote type"); Proposal storage proposal = proposals[proposalId]; Receipt storage receipt = proposal.receipts[voter]; require(receipt.hasVoted == false, "GovernorBravo::castVoteInternal: voter already voted"); uint96 votes = xvsVault.getPriorVotes(voter, proposal.startBlock); if (support == 0) { proposal.againstVotes = add256(proposal.againstVotes, votes); } else if (support == 1) { proposal.forVotes = add256(proposal.forVotes, votes); } else if (support == 2) { proposal.abstainVotes = add256(proposal.abstainVotes, votes); } receipt.hasVoted = true; receipt.support = support; receipt.votes = votes; return votes; } 382: function _setGuardian(address newGuardian) external { require(msg.sender == guardian || msg.sender == admin, "GovernorBravo::_setGuardian: admin or guardian only"); require(newGuardian != address(0), "GovernorBravo::_setGuardian: cannot live without a guardian"); address oldGuardian = guardian; guardian = newGuardian; emit NewGuardian(oldGuardian, newGuardian); } 458: function _setProposalMaxOperations(uint proposalMaxOperations_) external { require(msg.sender == admin, "GovernorBravo::_setProposalMaxOperations: admin only"); uint oldProposalMaxOperations = proposalMaxOperations; proposalMaxOperations = proposalMaxOperations_; emit ProposalMaxOperationsUpdated(oldProposalMaxOperations, proposalMaxOperations_); } 471: function _setPendingAdmin(address newPendingAdmin) external { // Check caller = admin require(msg.sender == admin, "GovernorBravo:_setPendingAdmin: admin only"); // Save current value, if any, for inclusion in log address oldPendingAdmin = pendingAdmin; // Store pendingAdmin with value newPendingAdmin pendingAdmin = newPendingAdmin; // Emit NewPendingAdmin(oldPendingAdmin, newPendingAdmin) emit NewPendingAdmin(oldPendingAdmin, newPendingAdmin); } 489: function _acceptAdmin() external { // Check caller is pendingAdmin and pendingAdmin ≠ address(0) require( msg.sender == pendingAdmin && msg.sender != address(0), "GovernorBravo:_acceptAdmin: pending admin only" ); // Save current values for inclusion in log address oldAdmin = admin; address oldPendingAdmin = pendingAdmin; // Store admin with value pendingAdmin admin = pendingAdmin; // Clear the pending value pendingAdmin = address(0); emit NewAdmin(oldAdmin, admin); emit NewPendingAdmin(oldPendingAdmin, pendingAdmin); } ``` [263](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L263) | [280](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L280) | [509](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L509) | [515](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L515) | [520](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L520) | [319](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L319) | [329](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L329) | [337](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L337) | [355](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L355) | [382](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L382) | [458](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L458) | [471](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L471) | [489](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L489) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 358: function getActions( uint proposalId ) external view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { Proposal storage p = proposals[proposalId]; return (p.targets, p.values, p.signatures, p.calldatas); } 375: function getReceipt(uint proposalId, address voter) external view returns (Receipt memory) { return proposals[proposalId].receipts[voter]; } 564: function add256(uint256 a, uint256 b) internal pure returns (uint) { uint c = a + b; require(c >= a, "addition overflow"); return c; } 570: function sub256(uint256 a, uint256 b) internal pure returns (uint) { require(b <= a, "subtraction underflow"); return a - b; } 575: function getChainIdInternal() internal pure returns (uint) { uint chainId; assembly { chainId := chainid() } return chainId; } 416: function castVote(uint proposalId, uint8 support) external { emit VoteCast(msg.sender, proposalId, support, castVoteInternal(msg.sender, proposalId, support), ""); } 426: function castVoteWithReason(uint proposalId, uint8 support, string calldata reason) external { emit VoteCast(msg.sender, proposalId, support, castVoteInternal(msg.sender, proposalId, support), reason); } 439: function castVoteBySig(uint proposalId, uint8 support, uint8 v, bytes32 r, bytes32 s) external { bytes32 domainSeparator = keccak256( abi.encode(DOMAIN_TYPEHASH, keccak256(bytes(name)), getChainIdInternal(), address(this)) ); bytes32 structHash = keccak256(abi.encode(BALLOT_TYPEHASH, proposalId, support)); bytes32 digest = keccak256(abi.encodePacked("\x19\x01", domainSeparator, structHash)); address signatory = ecrecover(digest, v, r, s); require(signatory != address(0), "GovernorBravo::castVoteBySig: invalid signature"); emit VoteCast(signatory, proposalId, support, castVoteInternal(signatory, proposalId, support), ""); } 457: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) { require(state(proposalId) == ProposalState.Active, "GovernorBravo::castVoteInternal: voting is closed"); require(support <= 2, "GovernorBravo::castVoteInternal: invalid vote type"); Proposal storage proposal = proposals[proposalId]; Receipt storage receipt = proposal.receipts[voter]; require(receipt.hasVoted == false, "GovernorBravo::castVoteInternal: voter already voted"); uint96 votes = xvsVault.getPriorVotes(voter, proposal.startBlock); if (support == 0) { proposal.againstVotes = add256(proposal.againstVotes, votes); } else if (support == 1) { proposal.forVotes = add256(proposal.forVotes, votes); } else if (support == 2) { proposal.abstainVotes = add256(proposal.abstainVotes, votes); } receipt.hasVoted = true; receipt.support = support; receipt.votes = votes; return votes; } 484: function _setGuardian(address newGuardian) external { require(msg.sender == guardian || msg.sender == admin, "GovernorBravo::_setGuardian: admin or guardian only"); require(newGuardian != address(0), "GovernorBravo::_setGuardian: cannot live without a guardian"); address oldGuardian = guardian; guardian = newGuardian; emit NewGuardian(oldGuardian, newGuardian); } 513: function _setProposalMaxOperations(uint proposalMaxOperations_) external { require(msg.sender == admin, "GovernorBravo::_setProposalMaxOperations: admin only"); uint oldProposalMaxOperations = proposalMaxOperations; proposalMaxOperations = proposalMaxOperations_; emit ProposalMaxOperationsUpdated(oldProposalMaxOperations, proposalMaxOperations_); } 526: function _setPendingAdmin(address newPendingAdmin) external { // Check caller = admin require(msg.sender == admin, "GovernorBravo:_setPendingAdmin: admin only"); // Save current value, if any, for inclusion in log address oldPendingAdmin = pendingAdmin; // Store pendingAdmin with value newPendingAdmin pendingAdmin = newPendingAdmin; // Emit NewPendingAdmin(oldPendingAdmin, newPendingAdmin) emit NewPendingAdmin(oldPendingAdmin, newPendingAdmin); } 544: function _acceptAdmin() external { // Check caller is pendingAdmin and pendingAdmin ≠ address(0) require( msg.sender == pendingAdmin && msg.sender != address(0), "GovernorBravo:_acceptAdmin: pending admin only" ); // Save current values for inclusion in log address oldAdmin = admin; address oldPendingAdmin = pendingAdmin; // Store admin with value pendingAdmin admin = pendingAdmin; // Clear the pending value pendingAdmin = address(0); emit NewAdmin(oldAdmin, admin); emit NewPendingAdmin(oldPendingAdmin, pendingAdmin); } ``` [358](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L358) | [375](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L375) | [564](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L564) | [570](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L570) | [575](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L575) | [416](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L416) | [426](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L426) | [439](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L439) | [457](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L457) | [484](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L484) | [513](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L513) | [526](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L526) | [544](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L544) ```solidity File: contracts/Governance/AccessControlledV8.sol 36: function __AccessControlled_init_unchained(address accessControlManager_) internal onlyInitializing { _setAccessControlManager(accessControlManager_); } 48: function setAccessControlManager(address accessControlManager_) external onlyOwner { _setAccessControlManager(accessControlManager_); } 55: function accessControlManager() external view returns (IAccessControlManagerV8) { return _accessControlManager; } ``` [36](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L36) | [48](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L48) | [55](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L55) ```solidity File: contracts/Governance/AccessControlledV5.sol 29: function accessControlManager() external view returns (IAccessControlManagerV5) { return _accessControlManager; } ``` [29](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV5.sol#L29) ```solidity File: contracts/Governance/Timelock.sol 98: function acceptAdmin() public { require(msg.sender == pendingAdmin, "Timelock::acceptAdmin: Call must come from pendingAdmin."); admin = msg.sender; pendingAdmin = address(0); emit NewAdmin(admin); } 154: function cancelTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public { require(msg.sender == admin, "Timelock::cancelTransaction: Call must come from admin."); bytes32 txHash = keccak256(abi.encode(target, value, signature, data, eta)); queuedTransactions[txHash] = false; emit CancelTransaction(txHash, target, value, signature, data, eta); } 209: function getBlockTimestamp() internal view returns (uint) { // solium-disable-next-line security/no-block-members return block.timestamp; } ``` [98](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L98) | [154](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L154) | [209](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L209) ```solidity File: contracts/Governance/TimelockV8.sol 112: function acceptAdmin() public { require(msg.sender == pendingAdmin, "Timelock::acceptAdmin: Call must come from pendingAdmin."); admin = msg.sender; pendingAdmin = address(0); emit NewAdmin(admin); } 169: function cancelTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public { require(msg.sender == admin, "Timelock::cancelTransaction: Call must come from admin."); bytes32 txHash = keccak256(abi.encode(target, value, signature, data, eta)); queuedTransactions[txHash] = false; emit CancelTransaction(txHash, target, value, signature, data, eta); } 224: function getBlockTimestamp() internal view returns (uint256) { // solium-disable-next-line security/no-block-members return block.timestamp; } ``` [112](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L112) | [169](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L169) | [224](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L224)

### [N-46] `constant`s should be defined rather than using magic numbers Magic numbers are hardcoded numerical values used directly in the code, making it harder to read and maintain. Consider using constants instead of magic numbers.

10 issue instances in 2 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit 600000e18 10: return 600000e18; /// @audit 300000e18 15: return 300000e18; /// @audit 10 20: return 10; /// @audit 60 30: return (60 * 60 * 24 * 3) / 3; /// @audit 24 30: return (60 * 60 * 24 * 3) / 3; ``` [10](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L10) | [15](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L15) | [20](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L20) | [30](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L30) | [30](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L30) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit 600000e18 10: return 600000e18; /// @audit 300000e18 15: return 300000e18; /// @audit 30 20: return 30; /// @audit 60 30: return (60 * 60 * 24 * 3) / 3; /// @audit 24 30: return (60 * 60 * 24 * 3) / 3; ``` [10](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L10) | [15](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L15) | [20](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L20) | [30](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L30) | [30](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L30)

### [N-47] Consider moving `msg.sender` checks to a common authorization `modifier` Functions that are only allowed to be called by a specific actor should use a modifier to check if the caller is the specified actor (e.g., owner, specific role, etc.). Using `require` to check `msg.sender` in the function body is less efficient and less clear. Consider refactoring these `require` statements into a modifier for better readability, organization, and gas efficiency.

44 issue instances in 7 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 149: require( xvs.getPriorVotes(msg.sender, sub256(block.number, 1)) > proposalThreshold(), 258: require( msg.sender == guardian || xvs.getPriorVotes(proposal.proposer, sub256(block.number, 1)) < proposalThreshold(), 351: require(msg.sender == guardian, "GovernorAlpha::__acceptAdmin: sender must be gov guardian"); 356: require(msg.sender == guardian, "GovernorAlpha::__abdicate: sender must be gov guardian"); 361: require(msg.sender == guardian, "GovernorAlpha::__queueSetTimelockPendingAdmin: sender must be gov guardian"); 366: require(msg.sender == guardian, "GovernorAlpha::__executeSetTimelockPendingAdmin: sender must be gov guardian"); ``` [149](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L149) | [258](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L258) | [351](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L351) | [356](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L356) | [361](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L361) | [366](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L366) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 60: require(msg.sender == admin, "GovernorBravo::initialize: admin only"); 104: require( xvsVault.getPriorVotes(msg.sender, sub256(block.number, 1)) > proposalThreshold, 237: require( msg.sender == guardian || msg.sender == proposal.proposer || xvsVault.getPriorVotes(proposal.proposer, sub256(block.number, 1)) < proposalThreshold, 383: require(msg.sender == guardian || msg.sender == admin, "GovernorBravo::_setGuardian: admin or guardian only"); 396: require(msg.sender == admin, "GovernorBravo::_setVotingDelay: admin only"); 412: require(msg.sender == admin, "GovernorBravo::_setVotingPeriod: admin only"); 429: require(msg.sender == admin, "GovernorBravo::_setProposalThreshold: admin only"); 446: require(msg.sender == admin, "GovernorBravo::_initiate: admin only"); 459: require(msg.sender == admin, "GovernorBravo::_setProposalMaxOperations: admin only"); 473: require(msg.sender == admin, "GovernorBravo:_setPendingAdmin: admin only"); 491: require( msg.sender == pendingAdmin && msg.sender != address(0), ``` [60](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L60) | [104](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L104) | [237](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L237) | [383](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L383) | [396](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L396) | [412](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L412) | [429](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L429) | [446](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L446) | [459](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L459) | [473](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L473) | [491](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L491) ```solidity File: contracts/legacy/GovernorAlpha2.sol 150: require( xvs.getPriorVotes(msg.sender, sub256(block.number, 1)) > proposalThreshold(), 259: require( msg.sender == guardian || xvs.getPriorVotes(proposal.proposer, sub256(block.number, 1)) < proposalThreshold(), 352: require(msg.sender == guardian, "GovernorAlpha::__acceptAdmin: sender must be gov guardian"); 357: require(msg.sender == guardian, "GovernorAlpha::__abdicate: sender must be gov guardian"); 362: require(msg.sender == guardian, "GovernorAlpha::__queueSetTimelockPendingAdmin: sender must be gov guardian"); 367: require(msg.sender == guardian, "GovernorAlpha::__executeSetTimelockPendingAdmin: sender must be gov guardian"); ``` [150](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L150) | [259](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L259) | [352](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L352) | [357](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L357) | [362](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L362) | [367](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L367) ```solidity File: contracts/Governance/Timelock.sol 87: require(msg.sender == address(this), "Timelock::setDelay: Call must come from Timelock."); 99: require(msg.sender == pendingAdmin, "Timelock::acceptAdmin: Call must come from pendingAdmin."); 111: require(msg.sender == address(this), "Timelock::setPendingAdmin: Call must come from Timelock."); 133: require(msg.sender == admin, "Timelock::queueTransaction: Call must come from admin."); 161: require(msg.sender == admin, "Timelock::cancelTransaction: Call must come from admin."); 184: require(msg.sender == admin, "Timelock::executeTransaction: Call must come from admin."); ``` [87](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L87) | [99](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L99) | [111](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L111) | [133](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L133) | [161](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L161) | [184](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L184) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 118: require(msg.sender == admin, "GovernorBravo::initialize: admin only"); 191: require( xvsVault.getPriorVotes(msg.sender, sub256(block.number, 1)) >= 331: require( msg.sender == guardian || msg.sender == proposal.proposer || xvsVault.getPriorVotes(proposal.proposer, sub256(block.number, 1)) < 485: require(msg.sender == guardian || msg.sender == admin, "GovernorBravo::_setGuardian: admin or guardian only"); 499: require(msg.sender == admin, "GovernorBravo::_initiate: admin only"); 514: require(msg.sender == admin, "GovernorBravo::_setProposalMaxOperations: admin only"); 528: require(msg.sender == admin, "GovernorBravo:_setPendingAdmin: admin only"); 546: require( msg.sender == pendingAdmin && msg.sender != address(0), ``` [118](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L118) | [191](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L191) | [331](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L331) | [485](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L485) | [499](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L499) | [514](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L514) | [528](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L528) | [546](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L546) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 48: require(msg.sender == admin, "GovernorBravoDelegator::_setImplementation: admin only"); ``` [48](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L48) ```solidity File: contracts/Governance/TimelockV8.sol 89: require(msg.sender == address(this), "Timelock::setDelay: Call must come from Timelock."); 113: require(msg.sender == pendingAdmin, "Timelock::acceptAdmin: Call must come from pendingAdmin."); 125: require(msg.sender == address(this), "Timelock::setPendingAdmin: Call must come from Timelock."); 148: require(msg.sender == admin, "Timelock::queueTransaction: Call must come from admin."); 176: require(msg.sender == admin, "Timelock::cancelTransaction: Call must come from admin."); 199: require(msg.sender == admin, "Timelock::executeTransaction: Call must come from admin."); ``` [89](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L89) | [113](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L113) | [125](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L125) | [148](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L148) | [176](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L176) | [199](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L199)

### [N-48] Style guide: Non-`external`/`public` function names should begin with an underscore In Solidity, it is suggested to use a leading underscore for non-public (private and internal) function names. This convention helps to distinguish clearly between public/external and non-public functions, improving code clarity. By adhering to this convention, developers can mitigate potential misinterpretation or errors, thus making the code more comprehensible and easier to maintain.

19 issue instances in 7 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 369: function add256(uint256 a, uint256 b) internal pure returns (uint) { 375: function sub256(uint256 a, uint256 b) internal pure returns (uint) { 380: function getChainId() internal pure returns (uint) { ``` [369](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L369) | [375](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L375) | [380](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L380) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 191: function queueOrRevertInternal( address target, uint value, string memory signature, bytes memory data, uint eta ) internal { 355: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) { 509: function add256(uint256 a, uint256 b) internal pure returns (uint) { 515: function sub256(uint256 a, uint256 b) internal pure returns (uint) { 520: function getChainIdInternal() internal pure returns (uint) { ``` [191](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L191) | [355](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L355) | [509](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L509) | [515](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L515) | [520](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L520) ```solidity File: contracts/legacy/GovernorAlpha2.sol 370: function add256(uint256 a, uint256 b) internal pure returns (uint) { 376: function sub256(uint256 a, uint256 b) internal pure returns (uint) { 381: function getChainId() internal pure returns (uint) { ``` [370](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L370) | [376](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L376) | [381](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L381) ```solidity File: contracts/Governance/Timelock.sol 209: function getBlockTimestamp() internal view returns (uint) { ``` [209](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L209) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 282: function queueOrRevertInternal( address target, uint value, string memory signature, bytes memory data, uint eta, uint8 proposalType ) internal { 457: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) { 564: function add256(uint256 a, uint256 b) internal pure returns (uint) { 570: function sub256(uint256 a, uint256 b) internal pure returns (uint) { 575: function getChainIdInternal() internal pure returns (uint) { ``` [282](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L282) | [457](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L457) | [564](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L564) | [570](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L570) | [575](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L575) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol 66: function delegateTo(address callee, bytes memory data) internal { ``` [66](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L66) ```solidity File: contracts/Governance/TimelockV8.sol 224: function getBlockTimestamp() internal view returns (uint256) { ``` [224](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L224)

### [N-49] Unused Function Parameters Function parameters that are not used within the function body can introduce confusion and reduce code clarity. It's recommended to comment out the variable name or remove it if not needed. This will not only improve the readability of the code but also suppress any compiler warnings associated with unused parameters. Ensure that removing or commenting out the parameter doesn't affect any function calls or overrides in derived contracts. If function is `virtual`, it's recommended to remove the parameter name from the function declaration.

1 issue instances in 1 files:

```solidity File: contracts/Governance/AccessControlManager.sol /// @audit `vToken` never used in function body or passed to modifiers /// @audit `newCollateralFactorMantissa` never used in function body or passed to modifiers /// @audit `newLiquidationThresholdMantissa` never used in function body or passed to modifiers 45: function setCollateralFactor(VToken vToken, uint256 newCollateralFactorMantissa, uint256 newLiquidationThresholdMantissa) external { ``` [45](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L45)

### [N-50] Consider defining system-wide constants in a single file System-wide constants should be declared in a single file for better maintainability and readability. This contract seems to contain constants which could potentially be system-wide and could be better managed if they were centralized in a single location.

12 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 6: string public constant name = "Venus Governor Alpha"; 105: bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)"); 109: bytes32 public constant BALLOT_TYPEHASH = keccak256("Ballot(uint256 proposalId,bool support)"); ``` [6](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L6) | [105](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L105) | [109](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L109) ```solidity File: contracts/legacy/GovernorAlpha2.sol 6: string public constant name = "Venus Governor Alpha"; 105: bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)"); 109: bytes32 public constant BALLOT_TYPEHASH = keccak256("Ballot(uint256 proposalId,bool support)"); ``` [6](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L6) | [105](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L105) | [109](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L109) ```solidity File: contracts/Governance/Timelock.sol 52: uint public constant GRACE_PERIOD = 14 days; 55: uint public constant MINIMUM_DELAY = 1 hours; 58: uint public constant MAXIMUM_DELAY = 30 days; ``` [52](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L52) | [55](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L55) | [58](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L58) ```solidity File: contracts/Governance/TimelockV8.sol 53: uint256 private constant DEFAULT_GRACE_PERIOD = 14 days; 56: uint256 private constant DEFAULT_MINIMUM_DELAY = 1 hours; 59: uint256 private constant DEFAULT_MAXIMUM_DELAY = 30 days; ``` [53](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L53) | [56](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L56) | [59](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L59)

### [N-51] Consider making contracts `Upgradeable` Contract uses a non-upgradeable design. Transitioning to an upgradeable contract structure is more aligned with contemporary smart contract practices. This approach not only enhances flexibility but also allows for continuous improvement and adaptation, ensuring the contract stays relevant and robust in an ever-evolving ecosystem.

17 issue instances in 11 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit - Contract `GovernorAlpha` is not upgradeable 3: contract GovernorAlpha { ``` [3](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L3) ```solidity File: contracts/legacy/GovernorBravoInterfaces.sol /// @audit - Contract `GovernorBravoEventsV1` is not upgradeable 12: contract GovernorBravoEventsV1 { /// @audit - Contract `GovernorBravoDelegatorStorage` is not upgradeable 73: contract GovernorBravoDelegatorStorage { /// @audit - Contract `GovernorBravoDelegateStorageV1` is not upgradeable 88: contract GovernorBravoDelegateStorageV1 is GovernorBravoDelegatorStorage { ``` [12](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L12) | [73](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L73) | [88](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L88) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit - Contract `GovernorBravoDelegateV1` is not upgradeable 11: contract GovernorBravoDelegateV1 is GovernorBravoDelegateStorageV1, GovernorBravoEventsV1 { ``` [11](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L11) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit - Contract `GovernorAlpha2` is not upgradeable 3: contract GovernorAlpha2 { ``` [3](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L3) ```solidity File: contracts/Governance/Timelock.sol /// @audit - Contract `Timelock` is not upgradeable 10: contract Timelock { ``` [10](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L10) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol /// @audit - Contract `GovernorBravoEvents` is not upgradeable 9: contract GovernorBravoEvents { /// @audit - Contract `GovernorBravoDelegatorStorage` is not upgradeable 71: contract GovernorBravoDelegatorStorage { /// @audit - Contract `GovernorBravoDelegateStorageV1` is not upgradeable 88: contract GovernorBravoDelegateStorageV1 is GovernorBravoDelegatorStorage { /// @audit - Contract `GovernorBravoDelegateStorageV2` is not upgradeable 186: contract GovernorBravoDelegateStorageV2 is GovernorBravoDelegateStorageV1 { ``` [9](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L9) | [71](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L71) | [88](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L88) | [186](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L186) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit - Contract `GovernorBravoDelegate` is not upgradeable 73: contract GovernorBravoDelegate is GovernorBravoDelegateStorageV2, GovernorBravoEvents { ``` [73](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L73) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol /// @audit - Contract `GovernorBravoDelegator` is not upgradeable 11: contract GovernorBravoDelegator is GovernorBravoDelegatorStorage, GovernorBravoEvents { ``` [11](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L11) ```solidity File: contracts/Governance/AccessControlManager.sol /// @audit - Contract `Comptroller` is not upgradeable 43: contract Comptroller is [...] AccessControlledV8 { /// @audit - Contract `AccessControlManager` is not upgradeable 52: contract AccessControlManager is AccessControl, IAccessControlManagerV8 { ``` [43](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L43) | [52](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L52) ```solidity File: contracts/Governance/TimelockV8.sol /// @audit - Contract `TimelockV8` is not upgradeable 12: contract TimelockV8 { ``` [12](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L12) ```solidity File: contracts/Governance/AccessControlledV5.sol /// @audit - Contract `AccessControlledV5` is not upgradeable 12: contract AccessControlledV5 { ``` [12](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV5.sol#L12)

### [N-52] Events that mark critical parameter changes should contain both the old and the new value When emitting events that signify critical changes in parameters, it's important to include both the old and new values. This aids in auditability, providing more complete information about the state change. It's especially necessary when the new value isn't required to be different from the old one, as this prevents ambiguity in event logs.

12 issue instances in 6 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 250: emit ProposalExecuted(proposalId); 275: emit ProposalCanceled(proposalId); ``` [250](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L250) | [275](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L275) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 226: emit ProposalExecuted(proposalId); 255: emit ProposalCanceled(proposalId); ``` [226](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L226) | [255](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L255) ```solidity File: contracts/legacy/GovernorAlpha2.sol 251: emit ProposalExecuted(proposalId); 276: emit ProposalCanceled(proposalId); ``` [251](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L251) | [276](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L276) ```solidity File: contracts/Governance/Timelock.sol 92: emit NewDelay(delay); 114: emit NewPendingAdmin(pendingAdmin); ``` [92](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L92) | [114](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L114) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 320: emit ProposalExecuted(proposalId); 350: emit ProposalCanceled(proposalId); ``` [320](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L320) | [350](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L350) ```solidity File: contracts/Governance/TimelockV8.sol 94: emit NewDelay(delay); 129: emit NewPendingAdmin(pendingAdmin); ``` [94](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L94) | [129](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L129)

### [N-53] Style guide: Non-`external`/`public` variable names should begin with an underscore The naming convention for non-public (private and internal) variables in Solidity recommends the use of a leading underscore. Since `constants` can be public, to avoid confusion, they should also be prefixed with an underscore. This practice clearly differentiates between public/external and non-public variables, enhancing code clarity and reducing the likelihood of misinterpretation or errors. Following this convention improves code readability and maintainability.

4 issue instances in 2 files:

```solidity File: contracts/Governance/Timelock.sol 80: function() external payable {} ``` [80](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L80) ```solidity File: contracts/Governance/TimelockV8.sol 53: uint256 private constant DEFAULT_GRACE_PERIOD = 14 days; 56: uint256 private constant DEFAULT_MINIMUM_DELAY = 1 hours; 59: uint256 private constant DEFAULT_MAXIMUM_DELAY = 30 days; ``` [53](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L53) | [56](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L56) | [59](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L59)

### [N-54] Style guide: Contract does not follow the Solidity style guide's suggested layout ordering Adhering to a recommended order in Solidity contracts enhances code readability and maintenance. [More information in Documentation](https://docs.soliditylang.org/en/latest/style-guide.html#order-of-layout) It's recommended to use the following order: 1. Type declarations 2. State variables 3. Events 4. Errors 5. Modifiers 6. Functions

9 issue instances in 6 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit `state variable` declared after `function` 34: TimelockInterface public timelock; /// @audit `type` declared after `state variable` 44: struct Proposal { /// @notice Unique id for looking up a proposal uint id; /// @notice Creator of the proposal address proposer; /// @notice The timestamp that the proposal will be available for execution, set once the vote succeeds uint eta; /// @notice the ordered list of target addresses for calls to be made address[] targets; /// @notice The ordered list of values (i.e. msg.value) to be passed to the calls to be made uint[] values; /// @notice The ordered list of function signatures to be called string[] signatures; /// @notice The ordered list of calldata to be passed to each call bytes[] calldatas; /// @notice The block at which voting begins: holders must delegate their votes prior to this block uint startBlock; /// @notice The block at which voting ends: votes must be cast prior to this block uint endBlock; /// @notice Current number of votes in favor of this proposal uint forVotes; /// @notice Current number of votes in opposition to this proposal uint againstVotes; /// @notice Flag marking whether the proposal has been canceled bool canceled; /// @notice Flag marking whether the proposal has been executed bool executed; /// @notice Receipts of ballots for the entire set of voters mapping(address => Receipt) receipts; } ``` [34](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L34) | [44](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L44) ```solidity File: contracts/legacy/GovernorBravoInterfaces.sol /// @audit `type` declared after `state variable` 115: struct Proposal { /// @notice Unique id for looking up a proposal uint id; /// @notice Creator of the proposal address proposer; /// @notice The timestamp that the proposal will be available for execution, set once the vote succeeds uint eta; /// @notice the ordered list of target addresses for calls to be made address[] targets; /// @notice The ordered list of values (i.e. msg.value) to be passed to the calls to be made uint[] values; /// @notice The ordered list of function signatures to be called string[] signatures; /// @notice The ordered list of calldata to be passed to each call bytes[] calldatas; /// @notice The block at which voting begins: holders must delegate their votes prior to this block uint startBlock; /// @notice The block at which voting ends: votes must be cast prior to this block uint endBlock; /// @notice Current number of votes in favor of this proposal uint forVotes; /// @notice Current number of votes in opposition to this proposal uint againstVotes; /// @notice Current number of votes for abstaining for this proposal uint abstainVotes; /// @notice Flag marking whether the proposal has been canceled bool canceled; /// @notice Flag marking whether the proposal has been executed bool executed; /// @notice Receipts of ballots for the entire set of voters mapping(address => Receipt) receipts; } ``` [115](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L115) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit `state variable` declared after `function` 34: TimelockInterface public timelock; /// @audit `type` declared after `state variable` 44: struct Proposal { /// @notice Unique id for looking up a proposal uint id; /// @notice Creator of the proposal address proposer; /// @notice The timestamp that the proposal will be available for execution, set once the vote succeeds uint eta; /// @notice the ordered list of target addresses for calls to be made address[] targets; /// @notice The ordered list of values (i.e. msg.value) to be passed to the calls to be made uint[] values; /// @notice The ordered list of function signatures to be called string[] signatures; /// @notice The ordered list of calldata to be passed to each call bytes[] calldatas; /// @notice The block at which voting begins: holders must delegate their votes prior to this block uint startBlock; /// @notice The block at which voting ends: votes must be cast prior to this block uint endBlock; /// @notice Current number of votes in favor of this proposal uint forVotes; /// @notice Current number of votes in opposition to this proposal uint againstVotes; /// @notice Flag marking whether the proposal has been canceled bool canceled; /// @notice Flag marking whether the proposal has been executed bool executed; /// @notice Receipts of ballots for the entire set of voters mapping(address => Receipt) receipts; } ``` [34](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L34) | [44](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L44) ```solidity File: contracts/Governance/Timelock.sol /// @audit `state variable` declared after `event` 52: uint public constant GRACE_PERIOD = 14 days; /// @audit `state variable` declared after `constructor` 80: function() external payable {} ``` [52](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L52) | [80](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L80) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol /// @audit `type` declared after `state variable` 115: struct Proposal { /// @notice Unique id for looking up a proposal uint id; /// @notice Creator of the proposal address proposer; /// @notice The timestamp that the proposal will be available for execution, set once the vote succeeds uint eta; /// @notice the ordered list of target addresses for calls to be made address[] targets; /// @notice The ordered list of values (i.e. msg.value) to be passed to the calls to be made uint[] values; /// @notice The ordered list of function signatures to be called string[] signatures; /// @notice The ordered list of calldata to be passed to each call bytes[] calldatas; /// @notice The block at which voting begins: holders must delegate their votes prior to this block uint startBlock; /// @notice The block at which voting ends: votes must be cast prior to this block uint endBlock; /// @notice Current number of votes in favor of this proposal uint forVotes; /// @notice Current number of votes in opposition to this proposal uint againstVotes; /// @notice Current number of votes for abstaining for this proposal uint abstainVotes; /// @notice Flag marking whether the proposal has been canceled bool canceled; /// @notice Flag marking whether the proposal has been executed bool executed; /// @notice Receipts of ballots for the entire set of voters mapping(address => Receipt) receipts; /// @notice The type of the proposal uint8 proposalType; } ``` [115](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L115) ```solidity File: contracts/Governance/TimelockV8.sol /// @audit `state variable` declared after `event` 53: uint256 private constant DEFAULT_GRACE_PERIOD = 14 days; ``` [53](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L53)

### [N-55] Using Low-Level Call for Transfers Directly using low-level calls for Ether transfers can introduce vulnerabilities and obscure the intent of your transfers. Adopt modern Solidity best practices by switching to recognized libraries like `SafeTransferLib.safeTransferETH` or `Address.sendValue`. This ensures safer transactions, enhances code clarity, and aligns with the standards of the Solidity community.

1 issue instances in 1 files:

```solidity File: contracts/Governance/TimelockV8.sol 217: (bool success, bytes memory returnData) = target.call{ value: value }(callData); ``` [217](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L217)

### [N-56] Consider bounding input array length The functions in question operate on arrays without established boundaries, executing function calls for each of their entries. If these arrays become excessively long, a function might revert due to gas constraints. To enhance user experience, consider incorporating a `require()` statement that enforces a sensible maximum array length. This approach can avoid unnecessary computational work and ensure smoother transactions.

1 issue instances in 1 files:

```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit `arrLength` equal to `proposalConfigs_.length` and it not bounded 136: for (uint256 i; i < arrLength; ++i) { ``` [136](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L136)

### [N-57] Constants in comparisons should appear on the left side Placing constants on the left side of comparison statements can help prevent accidental assignments and improve code readability. In languages like C, placing constants on the left can protect against unintended assignments that would be treated as true conditions, leading to bugs. Although Solidity does not have this specific issue, using the same practice can still be beneficial for code readability and consistency. Consider placing constants on the left side of comparison operators like `==`, `!=`, `<`, `>`, `<=`, and `>=`."

24 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 159: require(targets.length != 0, "GovernorAlpha::propose: must provide actions"); 163: if (latestProposalId != 0) { 304: } else if (proposal.eta == 0) { ``` [159](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L159) | [163](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L163) | [304](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L304) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 103: require(initialProposalId != 0, "GovernorBravo::propose: Governor Bravo not active"); 114: require(targets.length != 0, "GovernorBravo::propose: must provide actions"); 118: if (latestProposalId != 0) { 303: } else if (proposal.eta == 0) { 357: require(support <= 2, "GovernorBravo::castVoteInternal: invalid vote type"); 363: if (support == 0) { 365: } else if (support == 1) { 367: } else if (support == 2) { 447: require(initialProposalId == 0, "GovernorBravo::_initiate: can only initiate once"); ``` [103](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L103) | [114](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L114) | [118](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L118) | [303](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L303) | [357](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L357) | [363](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L363) | [365](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L365) | [367](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L367) | [447](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L447) ```solidity File: contracts/legacy/GovernorAlpha2.sol 160: require(targets.length != 0, "GovernorAlpha::propose: must provide actions"); 164: if (latestProposalId != 0) { 305: } else if (proposal.eta == 0) { ``` [160](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L160) | [164](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L164) | [305](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L305) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 190: require(initialProposalId != 0, "GovernorBravo::propose: Governor Bravo not active"); 202: require(targets.length != 0, "GovernorBravo::propose: must provide actions"); 206: if (latestProposalId != 0) { 398: } else if (proposal.eta == 0) { 459: require(support <= 2, "GovernorBravo::castVoteInternal: invalid vote type"); 465: if (support == 0) { 467: } else if (support == 1) { 469: } else if (support == 2) { 500: require(initialProposalId == 0, "GovernorBravo::_initiate: can only initiate once"); ``` [190](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L190) | [202](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L202) | [206](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L206) | [398](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L398) | [459](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L459) | [465](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L465) | [467](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L467) | [469](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L469) | [500](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L500)

### [N-58] Named Imports of Parent Contracts Are Missing It's important to have named imports for parent contracts to ensure code readability and maintainability. Missing named imports can make it difficult to understand the code hierarchy and can lead to issues in the future.

2 issue instances in 1 files:

```solidity File: contracts/Governance/AccessControlManager.sol /// @audit Missing named import for parent contract: `AccessControl` 52: contract AccessControlManager is AccessControl, IAccessControlManagerV8 { /// @audit Missing named import for parent contract: `IAccessControlManagerV8` 52: contract AccessControlManager is AccessControl, IAccessControlManagerV8 { ``` [52](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L52) | [52](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L52)

### [N-59] Long functions should be refactored into multiple, smaller, functions Functions that span many lines can be hard to understand and maintain. It is often beneficial to refactor long functions into multiple smaller functions. This improves readability, makes testing easier, and can even lead to gas optimization if it eliminates the need for variables that would otherwise have to be stored in memory.

5 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit 56 lines (excluding comments) 141: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { ``` [141](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L141) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit 58 lines (excluding comments) 95: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { ``` [95](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L95) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit 56 lines (excluding comments) 142: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { ``` [142](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L142) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit 45 lines (excluding comments) 111: function initialize( address xvsVault_, ProposalConfig[] memory proposalConfigs_, TimelockInterface[] memory timelocks, address guardian_ ) public { /// @audit 61 lines (excluding comments) 181: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description, ProposalType proposalType ) public returns (uint) { ``` [111](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L111) | [181](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L181)

### [N-60] `public` functions not called by the contract should be declared `external` instead Contracts are allowed to override their parents' functions and change the visibility from `external` to `public`. If a `public` function is not called internally within the contract, it should be declared as `external` to save gas.

43 issue instances in 7 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 141: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { 211: function queue(uint proposalId) public { 233: function execute(uint proposalId) public payable { 252: function cancel(uint proposalId) public { 277: function getActions( uint proposalId ) public view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { 288: function getReceipt(uint proposalId, address voter) public view returns (Receipt memory) { 314: function castVote(uint proposalId, bool support) public { 318: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public { 349: function __acceptAdmin() public { 354: function __abdicate() public { 359: function __queueSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { 364: function __executeSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { ``` [141](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L141) | [211](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L211) | [233](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L233) | [252](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L252) | [277](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L277) | [288](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L288) | [314](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L314) | [318](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L318) | [349](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L349) | [354](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L354) | [359](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L359) | [364](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L364) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 51: function initialize( address timelock_, address xvsVault_, uint votingPeriod_, uint votingDelay_, uint proposalThreshold_, address guardian_ ) public { 95: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { ``` [51](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L51) | [95](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L95) ```solidity File: contracts/legacy/GovernorAlpha2.sol 142: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { 212: function queue(uint proposalId) public { 234: function execute(uint proposalId) public payable { 253: function cancel(uint proposalId) public { 278: function getActions( uint proposalId ) public view returns (address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas) { 289: function getReceipt(uint proposalId, address voter) public view returns (Receipt memory) { 315: function castVote(uint proposalId, bool support) public { 319: function castVoteBySig(uint proposalId, bool support, uint8 v, bytes32 r, bytes32 s) public { 350: function __acceptAdmin() public { 355: function __abdicate() public { 360: function __queueSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { 365: function __executeSetTimelockPendingAdmin(address newPendingAdmin, uint eta) public { ``` [142](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L142) | [212](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L212) | [234](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L234) | [253](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L253) | [278](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L278) | [289](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L289) | [315](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L315) | [319](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L319) | [350](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L350) | [355](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L355) | [360](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L360) | [365](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L365) ```solidity File: contracts/Governance/Timelock.sol 86: function setDelay(uint delay_) public { 98: function acceptAdmin() public { 110: function setPendingAdmin(address pendingAdmin_) public { 126: function queueTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public returns (bytes32) { 154: function cancelTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public { 177: function executeTransaction( address target, uint value, string memory signature, bytes memory data, uint eta ) public payable returns (bytes memory) { ``` [86](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L86) | [98](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L98) | [110](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L110) | [126](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L126) | [154](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L154) | [177](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L177) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 111: function initialize( address xvsVault_, ProposalConfig[] memory proposalConfigs_, TimelockInterface[] memory timelocks, address guardian_ ) public { 181: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description, ProposalType proposalType ) public returns (uint) { ``` [111](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L111) | [181](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L181) ```solidity File: contracts/Governance/AccessControlManager.sol 77: function giveCallPermission(address contractAddress, string calldata functionSig, address accountToPermit) public { 91: function revokeCallPermission( address contractAddress, string calldata functionSig, address accountToRevoke ) public { 128: function hasPermission( address account, address contractAddress, string calldata functionSig ) public view returns (bool) { ``` [77](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L77) | [91](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L91) | [128](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L128) ```solidity File: contracts/Governance/TimelockV8.sol 88: function setDelay(uint256 delay_) public { 112: function acceptAdmin() public { 124: function setPendingAdmin(address pendingAdmin_) public { 141: function queueTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public returns (bytes32) { 169: function cancelTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public { 192: function executeTransaction( address target, uint256 value, string memory signature, bytes memory data, uint256 eta ) public payable returns (bytes memory) { ``` [88](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L88) | [112](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L112) | [124](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L124) | [141](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L141) | [169](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L169) | [192](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L192)

### [N-61] Unused Event Declarations Events that aren't emitted in the contract add unnecessary complexity to the codebase. Removing these unused events can streamline the contract, enhancing its readability and maintainability.

3 issue instances in 1 files:

```solidity File: contracts/Governance/IAccessControlManagerV5.sol /// @audit `RoleAdminChanged` event declared but never emitted 17: event RoleAdminChanged(bytes32 indexed role, bytes32 indexed previousAdminRole, bytes32 indexed newAdminRole); /// @audit `RoleGranted` event declared but never emitted 25: event RoleGranted(bytes32 indexed role, address indexed account, address indexed sender); /// @audit `RoleRevoked` event declared but never emitted 34: event RoleRevoked(bytes32 indexed role, address indexed account, address indexed sender); ``` [17](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV5.sol#L17) | [25](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV5.sol#L25) | [34](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/IAccessControlManagerV5.sol#L34)

### [N-62] Non-assembly High-Level Solidity Functions Available Usage of inline assembly can increase the complexity of a project and potentially introduce security risks. It's best to avoid using inline assembly where possible, especially when equivalent non-assembly methods are available.

4 issue instances in 4 files:

### [N-63] `else`-block not required In Solidity, if an `if` block contains a `return` statement, subsequent `else` blocks become unnecessary. This is because the `return` statement halts the execution of the function at that point, making any `else` conditions redundant. Therefore, omitting `else` after such `if` blocks can lead to cleaner and more readable code without any change in the functionality.

5 issue instances in 5 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 296: if (proposal.canceled) { return ProposalState.Canceled; } else if (block.number <= proposal.startBlock) { return ProposalState.Pending; } else if (block.number <= proposal.endBlock) { ``` [296](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L296) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 295: if (proposal.canceled) { return ProposalState.Canceled; } else if (block.number <= proposal.startBlock) { return ProposalState.Pending; } else if (block.number <= proposal.endBlock) { ``` [295](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L295) ```solidity File: contracts/legacy/GovernorAlpha2.sol 297: if (proposal.canceled) { return ProposalState.Canceled; } else if (block.number <= proposal.startBlock) { return ProposalState.Pending; } else if (block.number <= proposal.endBlock) { ``` [297](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L297) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 390: if (proposal.canceled) { return ProposalState.Canceled; } else if (block.number <= proposal.startBlock) { return ProposalState.Pending; } else if (block.number <= proposal.endBlock) { ``` [390](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L390) ```solidity File: contracts/Governance/AccessControlManager.sol 112: if (hasRole(role, account)) { return true; } else { role = keccak256(abi.encodePacked(address(0), functionSig)); return hasRole(role, account); } ``` [112](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L112)

### [N-64] Style guide: Function ordering does not follow the Solidity style guide Ordering helps readers identify which functions they can call and to find the constructor and fallback definitions easier. But there are contracts in the project that do not comply with this. Functions should be grouped according to their visibility and ordered: - constructor - receive function (if exists) - fallback function (if exists) - external - public - internal - private.

30 issue instances in 5 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit `function` declared before `constructor` 29: function votingPeriod() public pure returns (uint) { 135: constructor(address timelock_, address xvs_, address guardian_) public { /// @audit `internal` function `_queueOrRevert()` declared before `public` function `execute()` 225: function _queueOrRevert(address target, uint value, string memory signature, bytes memory data, uint eta) internal { 233: function execute(uint proposalId) public payable { /// @audit `internal` function `_castVote()` declared before `public` function `__acceptAdmin()` 329: function _castVote(address voter, uint proposalId, bool support) internal { 349: function __acceptAdmin() public { ``` [29](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L29) | [135](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L135) | [225](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L225) | [233](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L233) | [329](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L329) | [349](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L349) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit `public` function `propose()` declared before `external` function `queue()` 95: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description ) public returns (uint) { 172: function queue(uint proposalId) external { /// @audit `internal` function `queueOrRevertInternal()` declared before `external` function `execute()` 191: function queueOrRevertInternal( address target, uint value, string memory signature, bytes memory data, uint eta ) internal { 210: function execute(uint proposalId) external { /// @audit `public` function `state()` declared before `external` function `castVote()` 289: function state(uint proposalId) public view returns (ProposalState) { 319: function castVote(uint proposalId, uint8 support) external { /// @audit `internal` function `castVoteInternal()` declared before `external` function `_setGuardian()` 355: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) { 382: function _setGuardian(address newGuardian) external { ``` [95](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L95) | [172](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L172) | [191](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L191) | [210](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L210) | [289](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L289) | [319](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L319) | [355](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L355) | [382](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L382) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit `function` declared before `constructor` 29: function votingPeriod() public pure returns (uint) { 135: constructor(address timelock_, address xvs_, address guardian_, uint256 lastProposalId_) public { /// @audit `internal` function `_queueOrRevert()` declared before `public` function `execute()` 226: function _queueOrRevert(address target, uint value, string memory signature, bytes memory data, uint eta) internal { 234: function execute(uint proposalId) public payable { /// @audit `internal` function `_castVote()` declared before `public` function `__acceptAdmin()` 330: function _castVote(address voter, uint proposalId, bool support) internal { 350: function __acceptAdmin() public { ``` [29](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L29) | [135](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L135) | [226](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L226) | [234](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L234) | [330](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L330) | [350](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L350) ```solidity File: contracts/Governance/AccessControlledV8.sol /// @audit `internal` function `__AccessControlled_init_unchained()` declared before `external` function `setAccessControlManager()` 36: function __AccessControlled_init_unchained(address accessControlManager_) internal onlyInitializing { 48: function setAccessControlManager(address accessControlManager_) external onlyOwner { ``` [36](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L36) | [48](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L48) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit `public` function `propose()` declared before `external` function `queue()` 181: function propose( address[] memory targets, uint[] memory values, string[] memory signatures, bytes[] memory calldatas, string memory description, ProposalType proposalType ) public returns (uint) { 262: function queue(uint proposalId) external { /// @audit `internal` function `queueOrRevertInternal()` declared before `external` function `execute()` 282: function queueOrRevertInternal( address target, uint value, string memory signature, bytes memory data, uint eta, uint8 proposalType ) internal { 304: function execute(uint proposalId) external { /// @audit `public` function `state()` declared before `external` function `castVote()` 384: function state(uint proposalId) public view returns (ProposalState) { 416: function castVote(uint proposalId, uint8 support) external { /// @audit `internal` function `castVoteInternal()` declared before `external` function `_setGuardian()` 457: function castVoteInternal(address voter, uint proposalId, uint8 support) internal returns (uint96) { 484: function _setGuardian(address newGuardian) external { ``` [181](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L181) | [262](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L262) | [282](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L282) | [304](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L304) | [384](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L384) | [416](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L416) | [457](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L457) | [484](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L484)

### [N-65] Style guide: Lines are too long It is generally recommended that lines in the source code should not exceed 80-120 characters. Multiline output parameters and return statements should follow the same style recommended for wrapping long lines found in the Maximum Line Length section.

45 issue instances in 8 files:

```solidity File: contracts/legacy/GovernorAlpha.sol 8: /// @notice The number of votes in support of a proposal required in order for a quorum to be reached and for a vote to succeed ``` [8](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L8) ```solidity File: contracts/legacy/GovernorBravoInterfaces.sol 4: import { XvsVaultInterface, TimelockInterface, GovernorAlphaInterface } from "../Governance/GovernorBravoInterfaces.sol"; 10: * @dev This contract is included for archival and testing purposes as the ProposalCreated event has a different signature than the latest implementation. 86: * @dev This contract is included for archival and testing purposes as the Proposal struct has a different shape than the latest implementation. ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L4) | [10](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L10) | [86](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L86) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol 9: * It is included here for testing purposes because it has a different signature for the ProposalCreated event and Proposal struct 33: /// @notice The number of votes in support of a proposal required in order for a quorum to be reached and for a vote to succeed 468: * @dev Admin function to begin change of admin. The newPendingAdmin must call `_acceptAdmin` to finalize the transfer. ``` [9](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L9) | [33](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L33) | [468](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L468) ```solidity File: contracts/legacy/GovernorAlpha2.sol 8: /// @notice The number of votes in support of a proposal required in order for a quorum to be reached and for a vote to succeed ``` [8](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L8) ```solidity File: contracts/Governance/AccessControlledV8.sol 12: * @notice This contract is helper between access control manager and actual contract. This contract further inherited by other contract (using solidity 0.8.13) ``` [12](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L12) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol 8: * @notice Venus Governance latest on chain governance includes several new features including variable proposal routes and fine grained pause control. 9: * Variable routes for proposals allows for governance paramaters such as voting threshold and timelocks to be customized based on the risk level and 10: * impact of the proposal. Added granularity to the pause control mechanism allows governance to pause individual actions on specific markets, 13: * The goal of **Governance** is to increase governance efficiency, while mitigating and eliminating malicious or erroneous proposals. 20: * - XVSVault is the main staking contract for XVS. Users first stake their XVS in the vault and receive voting power proportional to their staked 30: * `GovernanceBravoDelegate` uses the XVSVault to get restrict certain actions based on a user's voting power. The governance rules it inforces are: 32: * - If a user's voting power drops below certain amount, anyone can cancel the the proposal. The governance guardian and proposal creator can also 37: * Venus Governance allows for Venus Improvement Proposals (VIPs) to be categorized based on their impact and risk levels. This allows for optimizing proposals 38: * execution to allow for things such as expediting interest rate changes and quickly updating risk parameters, while moving slower on other types of proposals 39: * that can prevent a larger risk to the protocol and are not urgent. There are three different types of VIPs with different proposal paramters: 51: * There is also a separate timelock executor contract for each route, which is used to dispatch the VIP for execution, giving even more control over the 56: * After a VIP is proposed, voting is opened after the `votingDelay` has passed. For example, if `votingDelay = 0`, then voting will begin in the next block 57: * after the proposal has been submitted. After the delay, the proposal state is `ACTIVE` and users can cast their vote `for`, `against`, or `abstain`, 58: * weighted by their total voting power (tokens + delegated voting power). Abstaining from a voting allows for a vote to be cast and optionally include a 59: * comment, without the incrementing for or against vote count. The total voting power for the user is obtained by calling XVSVault's `getPriorVotes`. 61: * `GovernorBravoDelegate` also accepts [EIP-712](https://eips.ethereum.org/EIPS/eip-712) signatures for voting on proposals via the external function 66: * A users voting power includes the amount of staked XVS the have staked as well as the votes delegate to them. Delegating is the process of a user loaning 67: * their voting power to another, so that the latter has the combined voting power of both users. This is an important feature because it allows for a user 70: * The delegation of votes happens through the `XVSVault` contract by calling the `delegate` or `delegateBySig` functions. These same functions can revert 95: /// @notice The number of votes in support of a proposal required in order for a quorum to be reached and for a vote to succeed 523: * @dev Admin function to begin change of admin. The newPendingAdmin must call `_acceptAdmin` to finalize the transfer. ``` [8](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L8) | [9](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L9) | [10](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L10) | [13](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L13) | [20](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L20) | [30](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L30) | [32](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L32) | [37](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L37) | [38](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L38) | [39](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L39) | [51](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L51) | [56](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L56) | [57](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L57) | [58](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L58) | [59](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L59) | [61](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L61) | [66](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L66) | [67](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L67) | [70](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L70) | [95](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L95) | [523](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L523) ```solidity File: contracts/Governance/AccessControlManager.sol 9: * @dev This contract is a wrapper of OpenZeppelin AccessControl extending it in a way to standartize access control within Venus Smart Contract Ecosystem. 10: * @notice Access control plays a crucial role in the Venus governance model. It is used to restrict functions so that they can only be called from one 13: * The implementation of `AccessControlManager`(https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/AccessControlManager.sol) 14: * inherits the [Open Zeppelin AccessControl](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/access/AccessControl.sol) 19: * Granular roles are built by hashing the contract address and its function signature. For example, given contract `Foo` with function `Foo.bar()` which 28: * Admin roles allow for an address to call a function signature on any contract guarded by the `AccessControlManager`. This is particularly useful for 31: * For Admin roles a null address is hashed in place of the contract address (`keccak256(0x0000000000000000000000000000000000000000,functionSignatureBar)`. 33: * In the previous example, giving account B the admin role, account B will have permissions to call the `bar()` function on any contract that is guarded by 38: * All restricted functions in Venus Protocol use a hook to ACM in order to check if the caller has the right permission to call the guarded function. 39: * `AccessControlledV5` and `AccessControlledV8` abstract contract makes this integration easier. They call ACM's external method 40: * `isAllowedToCall(address caller, string functionSig)`. Here is an example of how `setCollateralFactor` function in `Comptroller` is integrated with ACM: 45: function setCollateralFactor(VToken vToken, uint256 newCollateralFactorMantissa, uint256 newLiquidationThresholdMantissa) external { 103: * @dev Since restricted contracts using this function as a permission hook, we can get contracts address with msg.sender 122: * @dev This function is used as a view function to check permissions rather than contract hook for access restriction check. ``` [9](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L9) | [10](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L10) | [13](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L13) | [14](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L14) | [19](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L19) | [28](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L28) | [31](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L31) | [33](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L33) | [38](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L38) | [39](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L39) | [40](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L40) | [45](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L45) | [103](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L103) | [122](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L122) ```solidity File: contracts/Governance/AccessControlledV5.sol 9: * @notice This contract is helper between access control manager and actual contract. This contract further inherited by other contract (using solidity 0.5.16) ``` [9](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV5.sol#L9)

### [N-66] Style guide: Extraneous whitespace See the [whitespace](https://docs.soliditylang.org/en/v0.8.24/style-guide.html#whitespace-in-expressions) section of the Solidity Style Guide

12 issue instances in 7 files:

```solidity File: contracts/legacy/GovernorAlpha.sol /// @audit `More than one space around an assignment or other operator to align with another` 105: bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)"); ``` [105](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha.sol#L105) ```solidity File: contracts/legacy/GovernorBravoInterfaces.sol /// @audit `Immediately inside parenthesis, brackets or braces, with the exception of single line function declarations.` 4: import { XvsVaultInterface, TimelockInterface, GovernorAlphaInterface } from "../Governance/GovernorBravoInterfaces.sol"; /// @audit `Immediately inside parenthesis, brackets or braces, with the exception of single line function declarations.` 4: import { XvsVaultInterface, TimelockInterface, GovernorAlphaInterface } from "../Governance/GovernorBravoInterfaces.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L4) | [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L4) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit `More than one space around an assignment or other operator to align with another` 37: bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)"); ``` [37](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L37) ```solidity File: contracts/legacy/GovernorAlpha2.sol /// @audit `More than one space around an assignment or other operator to align with another` 105: bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)"); ``` [105](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorAlpha2.sol#L105) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit `More than one space around an assignment or other operator to align with another` 99: bytes32 public constant DOMAIN_TYPEHASH = keccak256("EIP712Domain(string name,uint256 chainId,address verifyingContract)"); /// @audit `More than one space around an assignment or other operator to align with another` 192: xvsVault.getPriorVotes(msg.sender, sub256(block.number, 1)) >= proposalConfigs[uint8(proposalType)].proposalThreshold, ``` [99](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L99) | [192](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L192) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol /// @audit `Immediately inside parenthesis, brackets or braces, with the exception of single line function declarations.` 82: (bool success, ) = implementation.delegatecall(msg.data); ``` [82](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L82) ```solidity File: contracts/Governance/TimelockV8.sol /// @audit `Immediately inside parenthesis, brackets or braces, with the exception of single line function declarations.` 3: import { ensureNonzeroAddress } from "@venusprotocol/solidity-utilities/contracts/validators.sol"; /// @audit `Immediately inside parenthesis, brackets or braces, with the exception of single line function declarations.` 217: (bool success, bytes memory returnData) = target.call{ value: value }(callData); /// @audit `Immediately inside parenthesis, brackets or braces, with the exception of single line function declarations.` 3: import { ensureNonzeroAddress } from "@venusprotocol/solidity-utilities/contracts/validators.sol"; /// @audit `Immediately inside parenthesis, brackets or braces, with the exception of single line function declarations.` 217: (bool success, bytes memory returnData) = target.call{ value: value }(callData); ``` [3](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L3) | [217](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L217) | [3](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L3) | [217](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L217)

### [N-67] Misplaced or Missing SPDX identifier The SPDX identifier was not found on the very first line of the file. Please ensure the SPDX identifier exists and placed correctly. For more information, please refer to the [SPDX specification](https://docs.soliditylang.org/en/latest/layout-of-source-files.html#spdx-license-identifier).

8 issue instances in 8 files:

### [N-68] Contract/Libraries Names Do Not Match Their Filenames According to the Solidity Style Guide, contract names should match their filenames. Mismatching contract names and filenames can lead to confusion and make the code harder to maintain and review.

3 issue instances in 3 files:

```solidity File: contracts/legacy/GovernorBravoInterfaces.sol 12: contract GovernorBravoEventsV1 { ``` [12](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L12) ```solidity File: contracts/Governance/GovernorBravoInterfaces.sol 9: contract GovernorBravoEvents { ``` [9](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoInterfaces.sol#L9) ```solidity File: contracts/Governance/AccessControlManager.sol 43: contract Comptroller is [...] AccessControlledV8 { ``` [43](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlManager.sol#L43)

### [N-69] Unused import The contract contains import statements for libraries or other contracts that are not utilized within the code. Excessive or unused imports can clutter the codebase, leading to inefficiency and potential confusion. Consider removing any imports that are not essential to the contract's functionality.

4 issue instances in 4 files:

```solidity File: contracts/legacy/GovernorBravoInterfaces.sol /// @audit imported `GovernorAlphaInterface` not used) 4: import { XvsVaultInterface, TimelockInterface, GovernorAlphaInterface } from "../Governance/GovernorBravoInterfaces.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoInterfaces.sol#L4) ```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit - GovernorBravoInterfaces imported but not used 4: import "./GovernorBravoInterfaces.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L4) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit - GovernorBravoInterfaces imported but not used 4: import "./GovernorBravoInterfaces.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L4) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol /// @audit - GovernorBravoInterfaces imported but not used 4: import "./GovernorBravoInterfaces.sol"; ``` [4](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L4)

### [N-70] `if`-statement can be converted to a ternary The ternary operator provides a shorthand way to write if / else statements. It can improve readability and reduce the number of lines of code. Traditional `if / else` statements, particularly those spanning only a one lines, could potentially be refactored using the ternary operator.

2 issue instances in 2 files:

```solidity File: contracts/Governance/Timelock.sol 194: if (bytes(signature).length == 0) { callData = data; } else { callData = abi.encodePacked(bytes4(keccak256(bytes(signature))), data); } ``` [194](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L194) ```solidity File: contracts/Governance/TimelockV8.sol 209: if (bytes(signature).length == 0) { callData = data; } else { callData = abi.encodePacked(bytes4(keccak256(bytes(signature))), data); } ``` [209](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L209)

### [N-71] Setters should prevent re-setting of the same value Setter functions should include a condition to check if the new value being assigned is different from the current value. This practice prevents redundant state changes and the emission of unnecessary events, ensuring that changes only occur when actual updates to the values are made. This not only helps to maintain the integrity of the contract's state but also keeps the event logs cleaner and more meaningful by avoiding the recording of identical consecutive values. Such an approach can improve the clarity and efficiency of debugging and data tracking processes.

15 issue instances in 6 files:

```solidity File: contracts/legacy/GovernorBravoDelegateV1.sol /// @audit Missing `newGuardian` check before state change 386: guardian = newGuardian; /// @audit Missing `newVotingDelay` check before state change 402: votingDelay = newVotingDelay; /// @audit Missing `newVotingPeriod` check before state change 418: votingPeriod = newVotingPeriod; /// @audit Missing `newProposalThreshold` check before state change 435: proposalThreshold = newProposalThreshold; /// @audit Missing `proposalMaxOperations_` check before state change 461: proposalMaxOperations = proposalMaxOperations_; /// @audit Missing `newPendingAdmin` check before state change 479: pendingAdmin = newPendingAdmin; ``` [386](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L386) | [402](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L402) | [418](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L418) | [435](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L435) | [461](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L461) | [479](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/legacy/GovernorBravoDelegateV1.sol#L479) ```solidity File: contracts/Governance/AccessControlledV8.sol /// @audit Missing `accessControlManager_` check before state change 49: _setAccessControlManager(accessControlManager_); ``` [49](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/AccessControlledV8.sol#L49) ```solidity File: contracts/Governance/Timelock.sol /// @audit Missing `delay_` check before state change 90: delay = delay_; /// @audit Missing `pendingAdmin_` check before state change 112: pendingAdmin = pendingAdmin_; ``` [90](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L90) | [112](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/Timelock.sol#L112) ```solidity File: contracts/Governance/GovernorBravoDelegate.sol /// @audit Missing `newGuardian` check before state change 488: guardian = newGuardian; /// @audit Missing `proposalMaxOperations_` check before state change 516: proposalMaxOperations = proposalMaxOperations_; /// @audit Missing `newPendingAdmin` check before state change 534: pendingAdmin = newPendingAdmin; ``` [488](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L488) | [516](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L516) | [534](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegate.sol#L534) ```solidity File: contracts/Governance/GovernorBravoDelegator.sol /// @audit Missing `implementation_` check before state change 55: implementation = implementation_; ``` [55](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/GovernorBravoDelegator.sol#L55) ```solidity File: contracts/Governance/TimelockV8.sol /// @audit Missing `delay_` check before state change 92: delay = delay_; /// @audit Missing `pendingAdmin_` check before state change 127: pendingAdmin = pendingAdmin_; ``` [92](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L92) | [127](https://github.com/VenusProtocol/governance-contracts//blob/main/contracts/Governance/TimelockV8.sol#L127)

### [N-72] Contracts should have full test coverage It's recommended to have full test coverage for all contracts. While 100% code coverage does not guarantee absence of bugs, it can catch simple bugs and reduce regressions during code modifications. Moreover, to achieve full coverage, authors often have to refactor their code into more modular components, each testable separately. This leads to lower interdependencies, and results in code that is easier to understand and audit.

1 issue instances in 1 files:

```solidity File: app/norace/governance-contracts 1: All files ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/app/norace/governance-contracts#L1)

### [N-73] Large or complicated code bases should implement invariant tests Large or complex code bases should include invariant fuzzing tests, such as those provided by Echidna. These tests require the identification of invariants that should not be violated under any circumstances, with the fuzzer testing various inputs and function calls to ensure these invariants always hold. This is especially important for code with a lot of inline-assembly, complicated math, or complex interactions between contracts. Despite having 100% code coverage, bugs can still occur due to the order of operations a user performs. Extensive and well-written invariant tests can significantly reduce this testing gap.

1 issue instances in 1 files:

```solidity File: app/norace/governance-contracts 1: All files ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/app/norace/governance-contracts#L1)

### [N-74] Implement Formal Verification Proofs to Improve Security Formal verification offers a mathematical proof confirming that your code operates as intended and is devoid of edge cases that may lead to unintended behavior. By leveraging this rigorous audit technique, you not only enhance the robustness of your code but also strengthen the trust of stakeholders in the safety of your contract.

1 issue instances in 1 files:

```solidity File: app/norace/governance-contracts 1: All files ``` [1](https://github.com/VenusProtocol/governance-contracts//blob/main/app/norace/governance-contracts#L1)

Competition	Date	Submissions	Payout
Morpho	Jul 15, 2025	1	$0
Nitro Labs	Jun 11, 2025	1	$0
Venus Protocol	Mar 22, 2024	2	$0

Slava S.

Public reviews