Require statements without messages in Basket

[code423n4]

Handle

pants

Vulnerability details

The functions and modifiers Basket.initialize(), Basket.validateWeights(), Basket.mintTo(), Basket.burn(), Basket.changePublisher(), Basket.changeLicenseFee(), Basket.publishNewIndex(), Basket.deleteNewIndex(), Basket.pullUnderlying(), Basket.onlyAuction() and Basket.onlyPublisher() contain a bunch of require statement without messages:

require(address(factory) == address(0));
require(!initialized);

require(_tokens.length > 0);
require(_tokens.length == _weights.length);
require(_tokens[i] != address(0));
require(_weights[i] > 0);
require(_tokens[i] != tokenList[x]);

require(auction.auctionOngoing() == false);
require(amount > 0);

require(auction.auctionOngoing() == false);
require(amount > 0);

require(newPublisher != address(0));
require(block.number >= pendingPublisher.block + TIMELOCK_DURATION);

require(newLicenseFee >= factory.minLicenseFee() && newLicenseFee != licenseFee);
require(block.number >= pendingLicenseFee.block + TIMELOCK_DURATION);

require(block.number >= pendingWeights.block + TIMELOCK_DURATION);

require(msg.sender == publisher || msg.sender == address(auction));
require(auction.auctionOngoing() == false);

require(tokenAmount > 0);

require(msg.sender == address(auction));

require(msg.sender == address(publisher));

Impact

When transactions revert, the users won't receive error messages indicating the cause of the failure.

Tool Used

Manual code review.

Recommended Mitigation Steps

Add informative error messages to these require statements.

[GalloDaSballo]

Personally I disagree that this would be a finding at all, that said I can rationalize these being informational findings, hence non-critical