Timeswap contest - 0x1f8b's results

• Low
  • 1. Mixing and Outdated compiler
  • 2. Use abstract for base contracts
  • 3. Avoid hardcoded values
  • 4. Integer overflow by unsafe casting

Low

1. Mixing and Outdated compiler

The pragma version used are:

pragma solidity =0.8.8;
pragma solidity ^0.8.0;

Note that mixing pragma is not recommended. Because different compiler versions have different meanings and behaviors, it also significantly raises maintenance costs. As a result, depending on the compiler version selected for any given file, deployed contracts may have security issues.

The minimum required version must be 0.8.17; otherwise, contracts will be affected by the following important bug fixes:

0.8.9:

• Immutables: Properly perform sign extension on signed immutables.
• User Defined Value Type: Fix storage layout of user defined value types for underlying types shorter than 32 bytes.

0.8.13:

• Code Generator: Correctly encode literals used in abi.encodeCall in place of fixed bytes arguments.

0.8.14:

• ABI Encoder: When ABI-encoding values from calldata that contain nested arrays, correctly validate the nested array length against calldatasize() in all cases.
• Override Checker: Allow changing data location for parameters only when overriding external functions.

0.8.15

• Code Generation: Avoid writing dirty bytes to storage when copying bytes arrays.
• Yul Optimizer: Keep all memory side-effects of inline assembly blocks.

0.8.16

• Code Generation: Fix data corruption that affected ABI-encoding of calldata values represented by tuples: structs at any nesting level; argument lists of external functions, events and errors; return value lists of external functions. The 32 leading bytes of the first dynamically-encoded value in the tuple would get zeroed when the last component contained a statically-encoded array.

0.8.17

• Yul Optimizer: Prevent the incorrect removal of storage writes before calls to Yul functions that conditionally terminate the external EVM call.

Apart from these, there are several minor bug fixes and improvements.

2. Use abstract for base contracts

abstract contracts are contracts that have at least one function without its implementation. An instance of an abstract cannot be created.

Reference:

• https://docs.soliditylang.org/en/v0.6.2/contracts.html#abstract-contracts

Affected source code:

• OwnableTwoSteps.sol:10
• NoDelegateCall.sol:6

3. Avoid hardcoded values

It is not good practice to hardcode values, but if you are dealing with addresses much less, these can change between implementations, networks or projects, so it is convenient to remove these values from the source code.

Affected source code:

• Base.sol:11
• Base.sol:15
• Base.sol:27
• StdUtils.sol:9
• Base.sol:11
• Base.sol:15
• Base.sol:17
• Base.sol:29
• StdUtils.sol:17

4. Integer overflow by unsafe casting

Keep in mind that the version of solidity used, despite being greater than 0.8, does not prevent integer overflows during casting, it only does so in mathematical operations.

It is necessary to safely convert between the different numeric types.

Recommendation:

Use a safeCast from Open Zeppelin.

    function blockTimestamp(uint96 durationForward) internal view virtual returns (uint96) {
        return uint96(block.timestamp + durationForward); // truncation is desired
    }

Affected source code:

• TimeswapV2Pool.sol:83

• Gas
  • 1. Optimize types
  • 2. Avoid compound assignment operator in state variables
    • Total gas saved: 13 * 66 = 858

Gas

1. Optimize types

Instead of checking that the integer does not exceed the expected type and casting it, it is better to use variables of that type in the constructor.

-   constructor(address chosenOwner, uint256 chosenTransactionFee, uint256 chosenProtocolFee) OwnableTwoSteps(chosenOwner) {
+   constructor(address chosenOwner, uint16 chosenTransactionFee, uint16 chosenProtocolFee) OwnableTwoSteps(chosenOwner) {
-       if (chosenTransactionFee > type(uint16).max) revert IncorrectFeeInitialization(chosenTransactionFee);
-       if (chosenProtocolFee > type(uint16).max) revert IncorrectFeeInitialization(chosenProtocolFee);

        transactionFee = chosenTransactionFee;
        protocolFee = chosenProtocolFee;
    }

Affected source code:

• TimeswapV2PoolFactory.sol:37-43

2. Avoid compound assignment operator in state variables

Using compound assignment operators for state variables (like State += X or State -= X ...) it's more expensive than using operator assignment (like State = State + X or State = State - X ...).

Proof of concept (without optimizations):

pragma solidity 0.8.15;

contract TesterA {
uint256 private _a;
function testShort() public {
_a += 1;
}
}

contract TesterB {
Uint256 private _a;
function testLong() public {
_a = _a + 1;
}
}

Gas saving executing: 13 per entry

TesterA.testShort: 43507
TesterB.testLong:  43494

Affected source code:

• TimeswapV2Option.sol:190
• TimeswapV2Option.sol:191
• TimeswapV2Option.sol:192
• TimeswapV2Option.sol:237
• TimeswapV2Option.sol:238
• TimeswapV2Option.sol:277
• Option.sol:62
• Option.sol:63
• Option.sol:65
• Option.sol:66
• Option.sol:68
• Option.sol:69
• Option.sol:103
• Option.sol:104
• Option.sol:108
• Option.sol:109
• Option.sol:112
• Option.sol:141
• Option.sol:142
• Option.sol:173
• Option.sol:174
• Option.sol:175
• Option.sol:177
• Option.sol:178
• Option.sol:179
• Option.sol:208
• Option.sol:209
• ERC1155Enumerable.sol:61
• ERC1155Enumerable.sol:95
• ERC1155Enumerable.sol:117
• FeesPosition.sol:31
• FeesPosition.sol:32
• FeesPosition.sol:33
• FeesPosition.sol:53
• FeesPosition.sol:54
• FeesPosition.sol:55
• FeesPosition.sol:59
• FeesPosition.sol:60
• FeesPosition.sol:61
• LiquidityPosition.sol:55
• LiquidityPosition.sol:56
• LiquidityPosition.sol:57
• LiquidityPosition.sol:66
• LiquidityPosition.sol:70
• LiquidityPosition.sol:71
• LiquidityPosition.sol:72
• LiquidityPosition.sol:76
• LiquidityPosition.sol:80
• LiquidityPosition.sol:81
• LiquidityPosition.sol:82
• Pool.sol:361
• Pool.sol:362
• Pool.sol:365
• Pool.sol:452
• Pool.sol:453
• Pool.sol:455
• Pool.sol:537
• Pool.sol:538
• Pool.sol:636
• Pool.sol:650
• Pool.sol:677
• Pool.sol:689
• Pool.sol:695
• Pool.sol:710
• Pool.sol:719
• Pool.sol:722

Total gas saved: 13 * 66 = 858