Backd Tokenomics contest - 0x29A's results

Maximize the power of your assets and start earning yield

General Information

Platform: Code4rena

Start Date: 27/05/2022

Pot Size: $75,000 USDC

Total HM: 20

Participants: 58

Period: 7 days

Judge: GalloDaSballo

Total Solo HM: 15

Id: 131

League: ETH

Backd

Findings Distribution

Researcher Performance

Rank: 28/58

Findings: 2

Award: $177.75

🌟 Selected for report: 0

πŸš€ Solo Findings: 0

Awards

119.8232 USDC - $119.82

Labels

bug
QA (Quality Assurance)
resolved
sponsor confirmed

External Links

QA

Use unchecked lib

PoolMigrationZap.sol

Enforce pattern on loops

You can add the unchecked math lib like you do on the others contracts to safely increment the i var, saving gas and make contract consistent with the others by enforcing the same style.

On PoolMigrationZap.sol#L39-L44 you are doing a unchecked increment in the loop, but in the rest of the code you a different pattern. Add the unchecked math lib and change:

        for (uint256 i; i < oldPoolAddresses_.length; ) {
            migrate(oldPoolAddresses_[i]);
            unchecked {
                ++i;
            }
        }

To;

        for (uint256 i; i < oldPoolAddresses_.length; i = i.uncheckedInc()) {
            migrate(oldPoolAddresses_[i]);
        }
_underlyingNewPools can end with a wrong data

If underlying_ is address(0) then _underlyingNewPools[address(0)] will be fill...

Consider change lines PoolMigrationZap.sol#L26-L27 from:

            _underlyingNewPools[underlying_] = newPool_;
            if (underlying_ == address(0)) continue;

To:

            if (underlying_ == address(0)) continue;
            _underlyingNewPools[underlying_] = newPool_;

ConvexStrategyBase.sol

Change var name to avoid shadow

On line L287 you are declaring variable with the same name, i understang that is for caching, but i recommend to change the variable name, consider changing this;

        address _swapperRouter = address(_swapperRouter);
        IERC20(token_).safeApprove(_swapperRouter, 0);
        IERC20(token_).safeApprove(_swapperRouter, type(uint256).max);

To this;

        address swapperRouter_ = address(_swapperRouter);
        IERC20(token_).safeApprove(swapperRouter_, 0);
        IERC20(token_).safeApprove(swapperRouter_, type(uint256).max);

LiquidityPool.sol

Add check before calling safeApprove

In think you will need a check before doing the safeApprove call on LiquidityPool.sol#L700 Just replace;

IERC20(lpToken_).safeApprove(staker_, type(uint256).max);

With

if (IERC20(lpToken_).allowance(staker_, spender) > 0) return;
IERC20(lpToken_).safeApprove(staker_, type(uint256).max);

_keeperGauge

Missing event emission

Critical function dont emit events; InflationManager.sol#L58-L63:setMinter InflationManager.sol#L89:deactivateWeightBasedKeeperDistribution

#0 - GalloDaSballo

2022-06-19T22:50:47Z

Enforce pattern on loops

Valid gas savings

_underlyingNewPools can end with a wrong data

Lack of address(0) check, valid

Change var name to avoid shadow

Agree with avoiding shadowing

Add check before calling safeApprove

Disagree that it's an issue

Missing event emission

Agree with informational level finding

#1 - GalloDaSballo

2022-06-19T22:51:16Z

Personally I recommend sorting by issue rather than by file, that said this report was pretty short which means either way of grouping findings is fine

Awards

57.93 USDC - $57.93

Labels

bug
G (Gas Optimization)
resolved
sponsor confirmed

External Links

Gas optimizations

Use unchecked lib to increment safe variables

PoolMigrationZap.sol

You can add the unchecked math lib like you do on the others contracts to safely increment the i var, saving gas and make contract consistent with the others by enforcing the same style.

Recommendation, add using UncheckedMath for uint256 And on line PoolMigrationZap.sol#L22 change;

for (uint256 i; i < newPools_.length; ++i) {

To

for (uint256 i; i < newPools_.length; i = i.uncheckedInc()) {

TopUpKeeperHelper.sol

On line TopUpKeeperHelper.sol#L52 you coul use unchecked math lib to increment the variable. Change:

topupsAdded++;

To:

topupsAdded = topupsAdded.uncheckedInc();

KeeperGauge.sol

On lines #L98 and L59 you could use unchecked math lib, consider change;

epoch++;

To;

epoch = epoch.uncheckedInc();

Use unchecked for decrement i

On BkdLocker.sol#L140 you can do a unchecked decrement (or add a function to the Unchecked math to do it) change;

i = i - 1;

to;

unchecked { --i; }

Cache .length

You could cache lenght of arrays to save gas; RewardHandler.sol#L41-L42 StakerVault.sol#L259 VestedEscrow.sol#L94

Use require(foo != 0) instead of require(foo > 0)

>0 is less gas efficient than !0 if you enable the optimizer at 10k AND you’re in a require statement.

BkdLocker.sol#L91 BkdLocker.sol#L92 BkdLocker.sol#L137 VestedEscrow.sol#L84 KeeperGauge.sol#L140 AmmGauge.sol#L104 AmmGauge.sol#L125

#0 - GalloDaSballo

2022-06-15T23:28:11Z

Use unchecked lib to increment safe variables Agree, this should save about 17 gas (20 gas minus the cost of the intermediary result, 3 gas) 3 * 17 = 51

Use unchecked for decrement i Agree, this should save around 25 gas (20 for unchecked + 5 for pre-decrement)

Cache .length Saves the cost of computing the offset, 3 gas 3*3 = 9

Use require(foo != 0) instead of require(foo > 0) Valid until 0.8.13, saves 3 gas per instance only with optimizer 7 * 3 = 21

Total Gas Saved 83

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax Β© 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter