---
# System prepended metadata

title: Tornado Diversification Proposal Audit

---

# Tornado Diversification Proposal Audit

## Scope Of Work

PR https://github.com/tornadocash/treasury-diversification-proposal/pull/2

Branch https://github.com/tornadocash/treasury-diversification-proposal/tree/1inch-limit-order


## Findings

### 1. executeProposal() Caller Protection
https://github.com/tornadocash/treasury-diversification-proposal/blob/1inch-limit-order/contracts/TreasuryDiversificationProposal.sol#L44

Severity: Informational

`executeProposal()` is expected to be called by the Governance contract only via delegatecall; however, it doesn't have protection. Thus, it allows anyone to call it. 

If anyone other than governance calls the method, it would fail on line 61 due to `initializeSale(...)` being guarded and only callable from governance. Anyone, other than Governance contract, attempting to call `executeProposal()` would experience failure and would cause gas waste.

```
ISaleHandler(saleHandler).initializeSale(wethAmount);
```

#### Recommendation
Because `executeProposal()` is called with delegate call using a modifier that relies on `msg.sender` or `tx.origin` that point to the original caller, not the Governance contract and thus would not achieve meaningful protection. In this situation, our advice is to add documentation about expected callers and behavior.  


### 2. README Readability Could Be Improved
https://github.com/tornadocash/treasury-diversification-proposal/blob/1inch-limit-order/README.md
Severity: Informational


README.md grammar could be slighly improved:
 
>- fully decentralized: Tornado DAO and [1Inch LimitOrderProtocol](https://docs.1inch.io/docs/limit-order-protocol/introduction) protocol are used to achieve it
> - crowd sale with fixed price and amount of tokens
> - Vesting TORN token (VTORN) is actually be sold:
>   - users can lock VTORN in Tornado governance for vesting period (see parameters section). In this case users can use them for governance voting and withdraw as TORN after vesting period.
>   - or they can just swap VTORN for the same value of TORN after vesting period


#### Recommendation

- Fully decentralized: Tornado DAO and [1Inch LimitOrderProtocol](https://docs.1inch.io/docs/limit-order-protocol/introduction) protocol are used to achieve it
 - Crowd sale with a fixed price and token amounts
 - Only Vesting TORN token (VTORN) to be sold:
   - Users can lock VTORN in Tornado governance for a vesting period (see parameters section). In which case users can use them for governance voting and withdraw as TORN after vesting period
   - Alternatively, users can swap VTORN for the same value of TORN after a vesting period.



### 3. Comment Typo

https://github.com/tornadocash/treasury-diversification-proposal/blob/1inch-limit-order/contracts/SaleHandler.sol#L65
Severity: Informational

> @notice 1Inch limit order protocol sugnature check method

#### Recommendation

"@notice 1Inch limit order protocol signature check method"



