QuantStamp Audit: QSP-2 - Treasury and its setter

[ongrid]

QuantStamp security assessment of v0.1.0-rc.1 raised the following security issue:

Issue: QSP-2

Short Descr.	Unresolved TODOs in code
Severity	Low Risk
Files affected	DePool.sol

Description

On L351, there is the comment: // TODO a separate vault. As of now, the function getInsuranceFund returns the same address as getTreasury.

Further, the treasury address is not part of the initialization and there is currently no way to update it. A setter function should be introduced for the treasury address. Similarly, the insurance fund address is not part of the initialization and there is currently no way to update it. A setter function should be introduced for the insurance fund address.

Steps to mitigate

• Add treasury addresses setter and corresponding docs and initializers
• Analyze the codebase for presence of //Todo, fixme and other IDE tags

[ujenjt]

Fixed in #233