Zellic - Audit Reports

Usage of magic numbers in various locations

It is generally not recommended to use magic numbers in code, as they make it harder to understand the logic and increase difficulty of refactoring the code.

Some examples of magic numbers were found in account_info.rs,

pub fn can_borrow_lamports(&self) -> Result<(), ProgramError> {
    let borrow_state = unsafe { (*self.raw).borrow_state };

    // check if mutable borrow is already taken
-    if borrow_state & 0b_1000_0000 != 0 {
        return Err(ProgramError::AccountBorrowFailed);
    }

    // check if we have reached the max immutable borrow count
-    if borrow_state & 0b_0111_0000 == 0b_0111_0000 {
        return Err(ProgramError::AccountBorrowFailed);
    }

    Ok(())
}

as well as instructions.rs,

fn from(account: &'a AccountInfo) -> Self {
    Account {
-        key: offset(account.raw, 8),
-        lamports: offset(account.raw, 72),
        data_len: account.data_len() as u64,
-        data: offset(account.raw, 88),
-        owner: offset(account.raw, 40),
        // The `rent_epoch` field is not present in the `AccountInfo` struct,
        // since the value occurs after the variable data of the account in
        // the runtime input data.
        rent_epoch: 0,
        is_signer: account.is_signer(),
        is_writable: account.is_writable(),
        executable: account.executable(),
        _account_info: PhantomData::<&'a AccountInfo>,
    }
}

and more (not listed for brevity).

To increase readability and make working with the code easier, we recommend finding all instances of magic numbers and replacing them with properly named constants.