Inconsistent state of _terminalsOf & _primaryTerminalOf state variables at JBDirectory

Lines of code Vulnerability details Vulnerability details When a call to setTerminalsOf is followed by setPrimaryTerminalOf, the state variables, terminalsOf & primaryTerminalOf, are maintained in consistent state by including the primaryTerminal in terminals also. Refer, But when a call to...

JBDirectory.primaryTerminalOf might suffer from out of gas DoS if too many terminals are added through JBDirectory._addTerminalIfNeeded

Lines of code Vulnerability details Impact There is no limit to the size of terminalsOf. if too many terminals are added through JBDirectory.addTerminalIfNeeded. JBDirectory.primaryTerminalOf might suffer from out of gas DoS. Proof of Concept The for loop in JBDirectory.primaryTerminalOf may caus...

JBProjects.createFor should be able to set the project controller

Lines of code Vulnerability details Impact JBProjects.createFor doesn’t set the project controller. Project owners need to call JBDirectory.setControllerOf to set the project controller. However, an allowedlisted address can set the controller before the actual project owner. We can assume that...