FactoryDAO contest - 0x1f8b's results

1. In the contract FixedPricePassThruGate, The method addGate must return the gateId in order to avoid user errors, otherwise it's hard to get the added gateId if in the same block was added more than one.

2. In the following contracts the methods addPool, addMerkleTree, addGate and addMerkleRoot must return the createdId in order to avoid user errors, otherwise it's hard to get the added createdId if in the same block was added more than one:

• MerkleDropFactory.addMerkleTree
• MerkleResistor.addMerkleTree
• MerkleIdentity.addMerkleTree
• MerkleVesting.addMerkleRoot
• PermissionlessBasicPoolFactory.sol#L102
• SpeedBumpPriceGate.sol#L39

3. Lack of input checks that could produce wrong deployments

• MerkleIdentity.sol#L53-L54
• PermissionlessBasicPoolFactory.sol#L75

4. Bad comment, the method says it will generate a new NFT, but there is no minting in the logic.

• MerkleIdentity.sol#L109

5. It was found some transfer without checking the boolean result, ERC20 standard specify that the token can return false if this call was not made, so it's mandatory to check the result of these methods.

• MerkleVesting.sol#L173

6. It's possible to create a pool with empty rewardTokenAddresses, fundPool will be automatic, getRewards will be empty too. So deposit and withdraw will be free of taxes.

7. Typo: reaffirm at VoterID.sol#L231

1. In the contract FixedPricePassThruGate, move the check of the msg.value>0 from line 51 to the addGate method, if is not possible to create a gate for _ethCost=0 this line could be removed because it's checked on line 48

2. There are require messages bigger than 32 bytes. More than 32 bytes for message will incur an extra gas costs.

• MerkleDropFactory.sol#L90
• MerkleDropFactory.sol#L92
• MerkleDropFactory.sol#L98
• MerkleIdentity.sol#L127
• MerkleResistor.sol#L83
• MerkleResistor.sol#L136
• MerkleResistor.sol#L171
• MerkleVesting.sol#L141
• MerkleVesting.sol#L145
• PermissionlessBasicPoolFactory.sol#L112
• PermissionlessBasicPoolFactory.sol#L214
• PermissionlessBasicPoolFactory.sol#L215
• PermissionlessBasicPoolFactory.sol#L245
• PermissionlessBasicPoolFactory.sol#L315
• VoterID.sol#L217
• VoterID.sol#L239
• VoterID.sol#L240
• VoterID.sol#L305-L306

3. Struct optimization at MerkleEligibility.sol#L19-L29 it's possible to remove one repeated key, the gateId from timesWithdrawn if it was moved to the Gate struct

struct Gate {
        bytes32 root;  // merkle root of whitelist
        uint maxWithdrawalsAddress; // maximum amount of withdrawals per address
        uint maxWithdrawalsTotal;  // maximum total withdrawals allowed, summed across all addresses
        uint totalWithdrawals;  // number of withdrawals already made
        mapping(address => uint) timesWithdrawn;
    }

4. Remove destination argument because is forced to be the same as sender from MerkleResistor.sol#L134

5. Change the incremental logic from i++ to ++i in order to save some opcodes:

• PermissionlessBasicPoolFactory.sol#L115
• PermissionlessBasicPoolFactory.sol#L141
• PermissionlessBasicPoolFactory.sol#L168
• PermissionlessBasicPoolFactory.sol#L224
• PermissionlessBasicPoolFactory.sol#L249
• PermissionlessBasicPoolFactory.sol#L266

6. Gas saving using immutable. It's possible to avoid storage access a save gas using immutable keyword for the following variables:

• VoterID.sol#L111-L113