QA Report

[code423n4]

N-01: Check newMax and oldMax values in setMaxDelegates function of ERC20MultiVotes.sol

Description

In the setMaxDelegates function for ERC20MultiVotes.sol, if newMax is less than oldMax there might be some accounts with more delegates than what the new maxDelegates value allows.

Adding the condition newMax >= oldMax would fix this issue.

N-02: Cannot set canContractExceedMaxDelegates to false in setContractExceedMaxDelegates function of ERC20MultiVotes.sol

Description

If the canExceedMax argument is set to false, the function canContractExceedMaxDelegates will revert not allowing an authorized admin to revoke the ability for an account to exceed the max delegates allowed.

Removing the canExceedMax from the condition in the function should allow canContractExceedMaxDelegates to be set to false.

[Joeysantoro]

N02 won't revert if false. https://github.com/fei-protocol/flywheel-v2/blob/main/src/token/ERC20MultiVotes.sol#L123 can only revert if the arg is true