Lint and slither

contracts/contracts/automation/CurvePoolBoosterBribesModule.sol

@@ -59,6 +59,7 @@ contract CurvePoolBoosterBribesModule is AbstractSafeModule {
         uint256 _additionalGasLimit
     ) AbstractSafeModule(_safeContract) {
         _grantRole(OPERATOR_ROLE, _operator);
+        // slither-disable-next-line cache-array-length
         for (uint256 i = 0; i < _poolBoosters.length; i++) {
             _addPoolBoosterAddress(_poolBoosters[i]);
         }
@@ -112,12 +113,12 @@ contract CurvePoolBoosterBribesModule is AbstractSafeModule {
     /// @dev Calls `manageCampaign` on each pool booster via the Safe. The Safe must hold
     ///      enough ETH to cover `bridgeFee * poolBoosters.length`.
     function manageBribes() external onlyOperator {
-        uint256[] memory totalRewardAmounts = new uint256[](
-            poolBoosters.length
-        );
-        uint8[] memory extraDuration = new uint8[](poolBoosters.length);
-        uint256[] memory rewardsPerVote = new uint256[](poolBoosters.length);
-        for (uint256 i = 0; i < poolBoosters.length; i++) {
+        uint256 poolBoosterCount = poolBoosters.length;
+
+        uint256[] memory totalRewardAmounts = new uint256[](poolBoosterCount);
+        uint8[] memory extraDuration = new uint8[](poolBoosterCount);
+        uint256[] memory rewardsPerVote = new uint256[](poolBoosterCount);
+        for (uint256 i = 0; i < poolBoosterCount; i++) {
             totalRewardAmounts[i] = type(uint256).max; // use all available rewards
             extraDuration[i] = 1; // extend by 1 period (week)
             rewardsPerVote[i] = 0; // no update to maxRewardPerVote
@@ -166,8 +167,9 @@ contract CurvePoolBoosterBribesModule is AbstractSafeModule {
     /// @dev Reverts if the address is already in the poolBoosters array
     /// @param _pool Address to append to the poolBoosters array
     function _addPoolBoosterAddress(address _pool) internal {
+        uint256 poolBoosterCount = poolBoosters.length;
         require(_pool != address(0), "Zero address");
-        for (uint256 j = 0; j < poolBoosters.length; j++) {
+        for (uint256 j = 0; j < poolBoosterCount; j++) {
             require(poolBoosters[j] != _pool, "Pool already added");
         }
         poolBoosters.push(_pool);

contracts/contracts/harvest/AbstractHarvester.sol

@@ -472,6 +472,10 @@ abstract contract AbstractHarvester is Governable {
      * @param _rewardTo Address where to send the share of harvest rewards to
      * @param _priceProvider Oracle to get prices of the swap token
      */
+    // This function is called by the harvestAndSwap function, which is only called by
+    // functions that have the nonReentrant modifier. Therefore, this function is also non-reentrant.
+    // slither-disable-start reentrancy-eth,reentrancy-no-eth,reentrancy-benign
+    // slither-disable-start reentrancy-events,reentrancy-unlimited-gas,reentrancy-balance
     function _swap(
         address _swapToken,
         address _rewardTo,
@@ -575,6 +579,9 @@ abstract contract AbstractHarvester is Governable {
         );
     }
 
+    // slither-disable-end reentrancy-events,reentrancy-unlimited-gas,reentrancy-balance
+    // slither-disable-end reentrancy-eth,reentrancy-no-eth,reentrancy-benign
+
     function _doSwap(
         SwapPlatform swapPlatform,
         address routerAddress,

contracts/contracts/poolBooster/PoolBoosterFactoryMerkl.sol

@@ -20,8 +20,12 @@ contract PoolBoosterFactoryMerkl is AbstractPoolBoosterFactory {
     /// --- STORAGE
     ////////////////////////////////////////////////////
 
+    // Keep this mutable storage slot to preserve layout compatibility.
+    // slither-disable-next-line constable-states
+    address private deprecated_beacon;
+
     /// @notice Address of the UpgradeableBeacon
-    address public beacon;
+    address public immutable beacon;
 
     ////////////////////////////////////////////////////
     /// --- CONSTRUCTOR
@@ -45,6 +49,7 @@ contract PoolBoosterFactoryMerkl is AbstractPoolBoosterFactory {
     /// --- CORE LOGIC
     ////////////////////////////////////////////////////
 
+    // slither-disable-start reentrancy-no-eth
     /// @notice Create a Pool Booster for Merkl using a BeaconProxy
     /// @param _ammPoolAddress Address of the AMM pool
     /// @param _initData Encoded call data for initializing the proxy
@@ -75,6 +80,8 @@ contract PoolBoosterFactoryMerkl is AbstractPoolBoosterFactory {
         );
     }
 
+    // slither-disable-end reentrancy-no-eth
+
     /// @notice Calls bribe() on all pool boosters, skipping those in the exclusion list
     /// @param _exclusionList A list of pool booster addresses to skip
     function bribeAll(address[] memory _exclusionList)

contracts/contracts/poolBooster/curve/CurvePoolBooster.sol

@@ -171,7 +171,7 @@ contract CurvePoolBooster is Initializable, Strategizable {
     ) external payable nonReentrant onlyGovernorOrStrategist {
         require(campaignId != 0, "Campaign not created");
 
-        uint256 rewardAmount;
+        uint256 rewardAmount = 0;
 
         if (totalRewardAmount != 0) {
             uint256 amount = min(

contracts/contracts/strategies/Generalized4626Strategy.sol

@@ -5,7 +5,7 @@ pragma solidity ^0.8.0;
  * @title Generalized 4626 Strategy
  * @notice Investment strategy for ERC-4626 Tokenized Vaults
  * @dev This strategy should not be used for the Morpho V2 Vaults as those are not
- *      completley ERC-4626 compliant - they don't implement the maxWithdraw() and 
+ *      completley ERC-4626 compliant - they don't implement the maxWithdraw() and
  *      maxRedeem() functions and rather return 0 when any of them is called.
  * @author Origin Protocol Inc
  */
@@ -145,7 +145,9 @@ contract Generalized4626Strategy is InitializableAbstractStrategy {
         nonReentrant
     {
         // @dev Don't use for Morpho V2 Vaults as below line will return 0
-        uint256 sharesToRedeem = IERC4626(platformAddress).maxRedeem(address(this));
+        uint256 sharesToRedeem = IERC4626(platformAddress).maxRedeem(
+            address(this)
+        );
 
         uint256 assetAmount = 0;
         if (sharesToRedeem > 0) {

contracts/contracts/strategies/MorphoV2Strategy.sol

@@ -12,7 +12,6 @@ import { IVaultV2 } from "../interfaces/morpho/IVaultV2.sol";
 import { Math } from "@openzeppelin/contracts/utils/math/Math.sol";
 
 contract MorphoV2Strategy is Generalized4626Strategy {
-
     /**
      * @param _baseConfig Base strategy config with Morpho V2 Vault and
      * vaultAddress (OToken Vault contract), eg VaultProxy or OETHVaultProxy

contracts/contracts/strategies/MorphoV2VaultUtils.sol

@@ -16,10 +16,11 @@ library MorphoV2VaultUtils {
      *      2) additional liquidity from the active adapter if it resolves to a Morpho V1 vault
      *         and, when provided, matches the expected adapter
      */
-    function maxWithdrawableAssets(
-        address platformAddress,
-        address assetToken
-    ) internal view returns (uint256 availableAssetLiquidity) {
+    function maxWithdrawableAssets(address platformAddress, address assetToken)
+        internal
+        view
+        returns (uint256 availableAssetLiquidity)
+    {
         availableAssetLiquidity = IERC20(assetToken).balanceOf(platformAddress);
 
         address liquidityAdapter = IVaultV2(platformAddress).liquidityAdapter();
@@ -34,5 +35,4 @@ library MorphoV2VaultUtils {
             revert IncompatibleAdapter(liquidityAdapter);
         }
     }
-
 }

contracts/contracts/strategies/crosschain/CrossChainRemoteStrategy.sol

@@ -153,11 +153,7 @@ contract CrossChainRemoteStrategy is
         );
 
         if (amountToWithdraw > 0) {
-            _withdraw(
-                address(this),
-                usdcToken,
-                amountToWithdraw
-            );
+            _withdraw(address(this), usdcToken, amountToWithdraw);
         }
     }
 

contracts/contracts/zapper/AbstractOTokenZapper.sol

@@ -68,6 +68,7 @@ abstract contract AbstractOTokenZapper {
         payable
         returns (uint256)
     {
+        // slither-disable-start reentrancy-balance
         uint256 balance = address(this).balance;
 
         emit Zap(msg.sender, ETH_MARKER, balance);
@@ -83,6 +84,7 @@ abstract contract AbstractOTokenZapper {
 
         require(mintedWOToken >= minReceived, "Zapper: not enough minted");
 
+        // slither-disable-end reentrancy-balance
         return mintedWOToken;
     }
 
@@ -96,6 +98,7 @@ abstract contract AbstractOTokenZapper {
         uint256 wethAmount,
         uint256 minReceived
     ) external returns (uint256) {
+        // slither-disable-start reentrancy-balance
         // slither-disable-next-line unchecked-transfer unused-return
         weth.transferFrom(msg.sender, address(this), wethAmount);
 
@@ -109,6 +112,7 @@ abstract contract AbstractOTokenZapper {
 
         require(mintedWOToken >= minReceived, "Zapper: not enough minted");
 
+        // slither-disable-end reentrancy-balance
         return mintedWOToken;
     }
 

contracts/contracts/zapper/OSonicZapper.sol

@@ -70,6 +70,7 @@ contract OSonicZapper {
         payable
         returns (uint256)
     {
+        // slither-disable-start reentrancy-balance
         uint256 balance = address(this).balance;
 
         emit Zap(msg.sender, ETH_MARKER, balance);
@@ -85,6 +86,7 @@ contract OSonicZapper {
 
         require(mintedWOS >= minReceived, "Zapper: not enough minted");
 
+        // slither-disable-end reentrancy-balance
         return mintedWOS;
     }
 
@@ -98,6 +100,7 @@ contract OSonicZapper {
         external
         returns (uint256)
     {
+        // slither-disable-start reentrancy-balance
         // slither-disable-next-line unchecked-transfer unused-return
         wS.transferFrom(msg.sender, address(this), wSAmount);
 
@@ -111,6 +114,7 @@ contract OSonicZapper {
 
         require(mintedWOS >= minReceived, "Zapper: not enough minted");
 
+        // slither-disable-end reentrancy-balance
         return mintedWOS;
     }
 

contracts/deploy/mainnet/179_upgrade_ousd_morpho_v2_strategy.js

@@ -19,7 +19,7 @@ module.exports = deploymentWithGovernanceProposal(
       "MorphoV2Strategy",
       [
         [addresses.mainnet.MorphoOUSDv2Vault, cVaultProxy.address],
-        addresses.mainnet.USDC
+        addresses.mainnet.USDC,
       ]
     );
 

contracts/test/strategies/crosschain/cross-chain-strategy.js

@@ -110,10 +110,9 @@ describe("ForkTest: CrossChainRemoteStrategy", function () {
       .connect(governor)
       .setLiquidityAdapter(morphoVault.address);
 
-    await expect(crossChainRemoteStrategy.connect(governor).withdrawAll())
-      .to.be.revertedWithCustomError(
-        "IncompatibleAdapter(address)"
-      );
+    await expect(
+      crossChainRemoteStrategy.connect(governor).withdrawAll()
+    ).to.be.revertedWithCustomError("IncompatibleAdapter(address)");
   });
 
   // Checks the diff in the total expected value in the vault

contracts/utils/morpho.js

@@ -33,12 +33,11 @@ async function morphoWithdrawShortfall() {
     addresses.mainnet.USDC
   );
 
-  const usdc = await ethers.getContractAt(
-    erc20Abi,
-    addresses.mainnet.USDC
+  const usdc = await ethers.getContractAt(erc20Abi, addresses.mainnet.USDC);
+  const vaultUSDCBalance = await usdc.balanceOf(
+    addresses.mainnet.MorphoOUSDv2Vault
   );
-  const vaultUSDCBalance = await usdc.balanceOf(addresses.mainnet.MorphoOUSDv2Vault);
-
+
   maxWithdrawal = maxWithdrawal.add(vaultUSDCBalance);
   log(
     `Morpho OUSD v2 Strategy USDC balance: ${formatUnits(