TODO/FIXME comments

Severity: Info ID: todo-comment

Flags TODO and FIXME markers left in comments, which signal unfinished work or known bugs that have not been resolved before the code reached production.

What it does

Scans every line, block, and NatSpec comment in the source file (//, /* */, ///, and /** */) and reports comments containing a TODO or FIXME marker.

A marker is recognized when it appears at the start of a whitespace-delimited token and is immediately followed by one of : ( , ; . ). Bare TODO and FIXME tokens are also recognized when they are the first meaningful token on a comment line or immediately follow a NatSpec tag such as @dev. A period does not count when followed by an alphanumeric character or underscore, preventing dotted names such as todo.md from matching. Matching is case-insensitive, so todo:, ToDo:, and FixMe: all match.

Why is this bad?

TODO and FIXME comments are development notes. Shipping them into production contracts signals incomplete work.

Example

Bad

contract Vault {
    // TODO: implement access control
    function withdraw() public {}

    // FIXME: this check is wrong
    function deposit(uint256 amount) public {
        require(amount > 0);
    }
}

Good

contract Vault {
    function withdraw() public onlyOwner {}

    function deposit(uint256 amount) public {
        require(amount > 0, "zero amount");
    }
}