Vader Protocol contest - 0x0x0x's results

Handle

0x0x0x

Vulnerability details

Proof of Concept

In solidity 0.8.*, there is already built in overflow check and using SafeMath consumes more gas without any advantage. In StakingRewards.sol, SafeMath is used with solidity 0.8.9.

Tools Used

Manual

Handle

0x0x0x

Vulnerability details

Proof of Concept

Example:

for (uint i = 0; i < arr.length; i++) {
//Operations not effecting the length of the array.
}

Loading length of array costs gas. Therefore, the length should be cached, if the length of the array doesn't change inside the loop. Recommended implementation:

uint length = arr.length;
for (uint i = 0; i < length; i++) {
//Operations not effecting the length of the array.
}

By doing so the length is only loaded once rather than loading it as many times as iterations (Therefore, less gas is spent).

Occurences

./governance/GovernorAlpha.sol:571:        for (uint256 i = 0; i < _targets.length; i++) {
./tokens/vesting/LinearVesting.sol:72:        for (uint256 i = 0; i < vesters.length; i++) {

Handle

0x0x0x

Vulnerability details

Proof of Concept

StakingRewards.sol#updateReward is:

    modifier updateReward(address account) {
        rewardPerTokenStored = rewardPerToken();
        lastUpdateTime = lastTimeRewardApplicable();
        if (account != address(0)) {
            rewards[account] = earned(account);
            userRewardPerTokenPaid[account] = rewardPerTokenStored;
        }
        _;
    }

The case where account != address(0) is a rare case, which only happens when notifyRewardAmount is called. For other functions we do not require the if statement: if (account != address(0)) { Therefore by splitting this modifier to two modifiers, we can hardcode the result of this if-statement to save gas.

Tools Used

Manual Analysis