Uninitialized `maturityDate` in `Strategy.create()`
The Strategy.create() function declares a maturityDate return value but never initializes or sets it.
The Strategy.create() function declares a maturityDate return value but never initializes or sets it. This uninitialized value, which defaults to 0, is returned and passed through to OperationalTreasury._buy(), where it's emitted via the LiquidityLocked event.
This leads to misleading or incorrect event logs, particularly showing maturityDate = 0.
The uninitialized value flows through to event emission:
function _buy(...) internal {// ...(sizeUSD, premium, maturityDate) = strategy.create(...);// maturityDate passed unchanged -> maturityDate: 0_emitEvent(optionID, amount, sizeUSD, buyToken, premium, fees, maturityDate);}
Ensure that Strategy.create() explicitly sets and returns a maturityDate.
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.