Platform: Code4rena
Start Date: 07/04/2022
Pot Size: $50,000 USDC
Total HM: 5
Participants: 19
Period: 5 days
Judge: 0xean
Total Solo HM: 4
Id: 109
League: COSMOS
Rank: 14/19
Findings: 1
Award: $131.23
🌟 Selected for report: 0
🚀 Solo Findings: 0
131.2305 USDC - $131.23
Context: ERC20.sol#L69-L72
, ERC20.sol#L81-L84
, ERC20.sol#L99-L107
, ERC20.sol#L121-L124
, ERC20.sol#L140-L143
, MintableCappedERC20.sol#L23-L28
, Ownable.sol#L20-L25
, EternalStorage.sol#L18-L20
, EternalStorage.sol#L22-L24
, EternalStorage.sol#L26-L28
, EternalStorage.sol#L30-L32
, EternalStorage.sol#L34-L36
, EternalStorage.sol#L38-L40
Description: Several functions across multiple contracts have a public visibility and can be marked with external visibility to save gas.
Recommendation: Change the functions visibility to external to save gas.
Context: AxelarGatewayMultisig.sol#L41-L49
, AxelarGatewayMultisig.sol#L114-L123
, AxelarGatewayMultisig.sol#L267-L276
Description: One can save gas by caching the array length (in stack) and using that set variable in the loop. Replace state variable reads and writes within loops with local variable reads and writes. This is done by assigning state variable values to new local variables, reading and/or writing the local variables in a loop, then after the loop assigning any changed local variables to their equivalent state variables.
Recommendation:
Simply do something like so before the for loop: uint length = variable.length
. Then add length
in place of variable.length
in the for loop.
Context: All Contracts
Description:
Contracts most called functions could simply save gas by function ordering via Method ID. Calling a function at runtime will be cheaper if the function is positioned earlier in the order (has a relatively lower Method ID) because 22 gas are added to the cost of a function for every position that came before it. The caller can save on gas if you prioritize most called functions. One could use This tool
to help find alternative function names with lower Method IDs while keeping the original name intact.
Recommendation:
Find a lower method ID name for the most called functions for example mostCalled()
vs. mostCalled_41q()
is cheaper by 44 gas.
Context: AxelarGateway.sol#L221-L228
, AxelarGatewayMultisig.sol#L136-L143
, AxelarGatewayMultisig.sol#L167-L191
, AxelarGatewayMultisig.sol#L267-L276
, AxelarGatewayMultisig.sol#L289-L296
, AxelarGatewayMultisig.sol#L318-L344
, AxelarGatewayMultisig.sol#L490-L575 (for both for loops)
, AdminMultisigBase.sol#L25-L54
, AdminMultisigBase.sol#L144-L168
Description: Due to reduced stack operations, using ++index saves 5 gas per iteration.
Recommendation: Use ++index to increment a loop counter.
Context: AxelarGateway.sol#L558-L560
Description: If there's a state variable you'll read from more than once in a function, it's best to cast it into memory.
Recommendation: Where state varibables are read from more than once in a function, cast it into memory and then use the casted varable.
Context: Ownable.sol#L10-L13
, BurnableMintableCappedERC20.sol#L21-L26
, MintableCappedERC20.sol#L14-L21
, ERC20Permit.sol#L22-L32
, ERC20.sol#L51-L59
, AxelarGatewayMultisig.sol#L39
, AxelarGateway.sol#L66-L68
, AxelarGatewayProxy.sol#L16-L24
Description:
You can cut out 10 opcodes in the creation-time EVM bytecode if you declare a constructor payable. Making the constructor payable eliminates the need for an initial check of msg.value == 0
and saves 21 gas on deployment with no security risks.
Recommendation: Set the constructor to payable.
#0 - deluca-mike
2022-04-13T23:43:05Z
Some disputed, some acknowledged, and some accepted.
Disputed, see "Save the array length in a local variable before the loop instead of accessing it in every iteration." in #9.
While true, this is a terrible way of writing Solidity, since it would result in every function's name depending on all other functions' existence. It's untenable, especially for upgradable/proxy contracts where a consistent interface is necessary. Disputed, and with prejudice, haha.
Confirmed.
The highlighted lines are:
function _checkTokenStatus(string memory symbol) internal view { if (getBool(_getFreezeTokenKey(symbol)) || getBool(KEY_ALL_TOKENS_FROZEN)) revert TokenIsFrozen(symbol); }
and no state variable is being read more than once, therefore disputed. Possibly a typo on the contestant's part?
Acknowledged, but prefer explicit non-payable constructors to the small gas savings, especially for infrequently called functionality.