Governance & Timelock Updates - Moonwell

The timelock delay is set to zero in the constructor. That can cause inconsistency in the proposals, and each proposal can bypass the timelock.

Code Location

Timelock.sol

    constructor(address admin_, uint delay_) public {
        require(delay_ >= MINIMUM_DELAY, "Timelock::constructor: Delay must exceed minimum delay.");
        require(delay_ <= MAXIMUM_DELAY, "Timelock::setDelay: Delay must not exceed maximum delay.");
        admin = admin_;
        delay = 0;
    }

SOLVED: The Moonwell Team solved this issue by setting the delay function.

Commit ID: 4e8bec5926339106c225d0f85120ba182e52f2dd

Role-only privileged functions that change critical parameters should emit events. Events allow changing parameters to be captured so that off-chain tools/interfaces can record such changes with timelocks allowing users to evaluate them and consider whether they would like to engage/exit based on how they perceive the changes to affect reliability of the protocol or profitability of implemented financial services. The alternative of directly querying the state of the on-chain contract for such changes is not considered practical for most users/usages.

Code Location

GovernorAlpha.sol

    function setProposalMaxOperations(uint newValue) public {
        require(msg.sender == address(timelock), "only timelock");
        proposalMaxOperations = newValue;
    }

    /// @notice The delay before voting on a proposal may take place, once proposed
    uint public votingDelay = 1 days;

    function setVotingDelay(uint newValue) public {
        require(msg.sender == address(timelock), "only timelock");
        votingDelay = newValue;        
    }

    /// @notice The duration of voting on a proposal, in blocks
    uint public votingPeriod = 3 days;
    function setVotingPeriod(uint newValue) public {
        require(msg.sender == address(timelock), "only timelock");
        votingPeriod = newValue;                
    }

SOLVED: The Moonwell Team solved this issue by adding events to functions.

Commit ID: 4e8bec5926339106c225d0f85120ba182e52f2dd

Regarding Solidity Style Guide, the variable definition can be moved to the beginning of the contract.

Code Location

GovernorAlpha.sol

    function setProposalMaxOperations(uint newValue) public {
        require(msg.sender == address(timelock), "only timelock");
        proposalMaxOperations = newValue;
    }

    /// @notice The delay before voting on a proposal may take place, once proposed
    uint public votingDelay = 1 days;

    function setVotingDelay(uint newValue) public {
        require(msg.sender == address(timelock), "only timelock");
        votingDelay = newValue;        
    }

    /// @notice The duration of voting on a proposal, in blocks
    uint public votingPeriod = 3 days;
    function setVotingPeriod(uint newValue) public {
        require(msg.sender == address(timelock), "only timelock");
        votingPeriod = newValue;                
    }

SOLVED: The Moonwell Team solved this issue by placing variables at the beginning of the contract.

Commit ID: 4e8bec5926339106c225d0f85120ba182e52f2dd