diff --git a/config.example.toml b/config.example.toml
index cdecf4c..7537e3a 100644
--- a/config.example.toml
+++ b/config.example.toml
@@ -64,7 +64,7 @@ badge = 1
 is_mod = true # can request mod access ingame
 text_color = [200, 255, 200]
 [ranks.mod.permissions]
-rate_levels = true       # todo: unimplemented
+rate_levels = true
 rate_levels_demon = true # todo: unimplemented
 
 [ranks.eldermod]
diff --git a/src/endpoints/comments/deleteProfileComment.cr b/src/endpoints/comments/deleteProfileComment.cr
index c6f9441..d2913c9 100644
--- a/src/endpoints/comments/deleteProfileComment.cr
+++ b/src/endpoints/comments/deleteProfileComment.cr
@@ -16,7 +16,6 @@ CrystalGauntlet.endpoints["/deleteGJAccComment20.php"] = ->(context : HTTP::Serv
   # kind of a dumb hack, but it works
   target_account_id = DATABASE.scalar("select max(account_id) from account_comments where id = ?", comment_id).as(Int64 | Nil)
 
-  # todo: let mods delete any comment
   if target_account_id && account_id == target_account_id
     DATABASE.exec("delete from account_comments where id = ?", comment_id)
     return "1"
diff --git a/src/endpoints/levels/rateLevel.cr b/src/endpoints/levels/rateLevel.cr
index 4f06da3..00ab8bd 100644
--- a/src/endpoints/levels/rateLevel.cr
+++ b/src/endpoints/levels/rateLevel.cr
@@ -13,8 +13,6 @@ CrystalGauntlet.endpoints["/rateGJStars211.php"] = ->(context : HTTP::Server::Co
     return "-1"
   end
 
-  # todo: implement this for mod accounts
-
   if DATABASE.scalar("select count(*) from levels where id = ?", level_id).as(Int64) == 0
     return "-1"
   end
diff --git a/src/endpoints/users/getScores.cr b/src/endpoints/users/getScores.cr
index 914bc82..4cdad81 100644
--- a/src/endpoints/users/getScores.cr
+++ b/src/endpoints/users/getScores.cr
@@ -31,7 +31,6 @@ CrystalGauntlet.endpoints["/getGJScores20.php"] = ->(context : HTTP::Server::Con
     offset = DATABASE.scalar("select count(*) from users where stars > ?", stars).as(Int64)
     offset = Math.max(offset - 10, 0)
   when "friends"
-    # todo
     user_id, account_id = Accounts.auth(params)
     if !(user_id && account_id)
       return "-1"
diff --git a/src/lib/songs.cr b/src/lib/songs.cr
index 9de56bc..f98f5db 100644
--- a/src/lib/songs.cr
+++ b/src/lib/songs.cr
@@ -111,6 +111,7 @@ module CrystalGauntlet::Songs
   # name, author id, author name, size, download url
   # returns nil if song should be disabled
   # throws if something failed
+  # todo: why is size sometimes 0.00 despite the song being downloaded?
   def fetch_song(song_id : Int32, get_download = false) : Tuple(String, Int32, String, Int32 | Nil, String | Nil) | Nil
     LOG.debug { "fetching #{song_id}" }
     if !config_get("songs.allow_custom_songs").as?(Bool)