# Election & Vote tokens contracts

## Fixes:

- Highly Permissive Role Access: fixed in [PR#5](https://github.com/aurora-is-near/aurora-election-contracts/pull/5).
- Missing Events: fixed in [PR#7](https://github.com/aurora-is-near/aurora-election-contracts/pull/7)
- Missing Allowance check: fixed in [PR#9](https://github.com/aurora-is-near/aurora-election-contracts/pull/9). **Do we really need this check ?**
- Style Guide Violation: fixed in [commit#1f04b38](https://github.com/aurora-is-near/aurora-election-contracts/commit/1f04b383da6c07008b25f8b1d876a3e928a4b0ed)
- Requirements Violation `burn` function : fixed in [PR#11](https://github.com/aurora-is-near/aurora-voting-contracts/pull/11)
- Changing _balances visibility to `private`: fix in [PR#12](https://github.com/aurora-is-near/aurora-voting-contracts/pull/12)
- Floating Pragma: fix in [commit#b56240c](https://github.com/aurora-is-near/aurora-voting-contracts/commit/b56240c24d537a0a836122b98a167d73e483d998)
- Functions that Can Be Declared External: fixed in [commit#20ec529](https://github.com/aurora-is-near/aurora-voting-contracts/commit/20ec52997a3925159e2e265638624fd1451701c5)
- Variable Shadowing `_name` & `_symbol`: fixed in [commit#f7b92a0](https://github.com/aurora-is-near/aurora-voting-contracts/commit/f7b92a0d1ea4324029e38a9be5410fdfab251832)
- Tests for multiple users: It is already covered for multiple users and multiple candidates.
- Some loops may run out of gas: Add more testing for this issue in [PR#12](https://github.com/aurora-is-near/aurora-election-contracts/pull/12)
- Assert Violation for getter function: tests were added in [PR#14](https://github.com/aurora-is-near/aurora-election-contracts/pull/14)
## Questions & Notes:

1. **Block numbers should not be used for time calculations**:

The contracts only use the `block.timestamp` not `block.number`. I know it is not recommended to not even rely on the `block.timestamp`, However the assumption that we trust the Aurora/Near validators for maintining the right timestamp. So I think this is a false positive issue ?

2. **Requirements Violation**

Contracts are not designed for actual voting and do not follow best practices for voting tokens. When using a simple ERC20 token to calculate votes, voting results can be manipulated. The system may not work as expected.
Paths: ./contracts/AuroraVoteTokenV1.sol, ./contracts/ERC20VotesUpgradeable.sol
*Recommendation: implement voting functionality or never use the implementation in contracts other than ElectionManager.*

**Comments:**
- Can you please add more information about this issue:
- What is the best practice for the vote token (e.g reference implementation, etc?)
- Please specify how the results can be manuplated ? which part of the code may not work as expected ?

3. **Misleading Function**

The `delegate` function executes the exact same code as the `transfer` function. The function name contradicts its functionality.
Path: ./contracts/AuroraVoteTokenV1.sol
Recommendation: use transfer function only to override the ERC20 transfer function and remove the delegate function.

**comment:** This is an intended behaviour. It is a part of the business requirements, but it was verbally communicated. The intension is to provide both interfaces (`transfer` and `delegate`). The `transfer` is only for whitelisted addresses, however anyone can call `delegate` function.

4. **Total Supply initialization:**
The project documentation specifies the total amount of tokens (1B Tokens), but the contract leaves the choice to the owner when initializing the contract.

**Comment:** *The contract was already **deployed** with the right value.*

5. **Managing roles:**

Only addresses with privileges can use the transferFrom function of the VOTE token. Therefore, the ElectionManager contract must be whitelisted in the token contract in order to process the user’s vote.

**Comment:** there are two scripts(add/remove) roles for managing the role lifecycle. These scripts will be used for managing whitelisting the addresses to access the `transferFrom`. For more info, please refer to these [scripts](https://github.com/aurora-is-near/aurora-voting-contracts/tree/main/scripts).