Yieldy contest - 0xf15ers's results

1. Return value is ignored

• The return value of IERC20Upgradeable(rewardToken).approve(....) is not handled.
• Consider adding require() guard to handle the returned bool.

2. Add a guard check for epoch's endtime

• While setting the Epoch's endtime, add a guard check require() for _firstEpochEndTime > block.timestamp to prevent unintended consequences.

3. Unused storage variable

• MAX_UINT256 in YieldyStorage.sol#L18 is not used anywhere.

1. Individual require() is preferred in over multiple &&

• In Staking.sol#L55-L63, intead of using && multiple times, mutliple require() can be used to save gas.

2. Change constants into immutable in YieldyStorage.sol

• Constant keccak variables are treated as expressions, not constant and are re-evaluated every time.
• It is recommended to change to immutable
• https://github.com/code-423n4/2022-06-yieldy/blob/524f3b83522125fb7d4677fa7a7e5ba5a2c0fe67/src/contracts/YieldyStorage.sol#L10-L13

bytes32 public immutable ADMIN_ROLE = keccak256("ADMIN");
bytes32 public immutable MINTER_BURNER_ROLE = keccak256("MINTER_BURNER_ROLE");
bytes32 public immutable REBASE_ROLE = keccak256("REBASE_ROLE");

3. Making public functions not called internally can be made external to save gas

• In Yieldy.sol, the visibility of balanceOf(), transfer(), transferFrom(), decimals() can be made external to save gas.
• link

4. Using > 0 costs more gas than != 0 when used on a uint in a require() statement

• In Staking.sol's stake(),instantUnstakeReserve(), instantUnstakeCurve()

function stake(uint256 _amount, address _recipient) public {
..............
       require(_amount > 0, "Must have valid amount");
       ...

5. Use solidity custom errors

solidity 0.8.4 introduces custom errors which are cheaper than using revert strings in terms of gas Use the custom error patterns to reduce gas cost.

for eg.

  // Before
  require(condition, "Revert strings");

  // After
  error CustomError();
  if (!condition) {
    revert CustomError();
  }

more details can be found here