Illuminate contest - 0xkatana's results

Your Sole Source For Fixed-Yields.

General Information

Platform: Code4rena

Start Date: 21/06/2022

Pot Size: $55,000 USDC

Total HM: 29

Participants: 88

Period: 5 days

Judge: gzeon

Total Solo HM: 7

Id: 134

League: ETH

Illuminate

Findings Distribution

Researcher Performance

Rank: 42/88

Findings: 1

Award: $147.51

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository Illuminate

Findings Information

🌟 Selected for report: BowTiedWardens

Also found by: 0v3rf10w, 0x1f8b, 0x29A, 0xKitsune, 0xNazgul, 0xf15ers, 0xkatana, 0xkowloon, Bnke0x0, ElKu, Fitraldys, Funen, GalloDaSballo, IllIllI, JC, Kaiziron, Lambda, MadWookie, Noah3o6, Nyamcil, RoiEvenHaim, TomJ, Tomio, UnusualTurtle, Waze, _Adam, ajtra, asutorufos, bardamu, c3phas, catchup, datapunk, defsec, delfin454000, fatherOfBlocks, grGred, hake, hansfriese, hyh, ignacio, joestakey, kebabsec, ladboy233, oyc_109, pashov, poirots, rfa, robee, sach1r0, samruna, sashik_eth, simon135, slywaters, z3s, zer0dot

Awards

147.5086 USDC - $147.51

Labels

bug

G (Gas Optimization)

External Links

Link to GitHub issue

[G-01] Redundant zero initialization

Solidity does not recognize null as a value, so uint variables are initialized to zero. Setting a uint variable to zero is redundant and can waste gas.

Locations where this was found include https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L265

Recommended Mitigation Steps

Remove the redundant zero initialization uint256 i; instead of uint256 i = 0;

[G-02] Split up require statements instead of &&

Combining require statement conditions with && logic uses unnecessary gas. It is better to split up each part of the logical statement into a separate require statements

Locations where this was found include https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20Permit.sol#L79

Recommended Mitigation Steps

Use separate require statements instead of concatenating with &&

[G-03] Use != 0 instead of > 0

Using > 0 uses slightly more gas than using != 0. Use != 0 when comparing uint variables to zero, which cannot hold values below zero

Locations where this was found include https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L662

Recommended Mitigation Steps

Replace > 0 with != 0 to save gas

[G-04] Use prefix not postfix in loops

Using a prefix increment (++i) instead of a postfix increment (i++) saves gas for each loop cycle and so can have a big gas impact when the loop executes on a large number of elements.

Locations where this was found include https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L96 https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L120 https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L283 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20Permit.sol#L64

Recommended Mitigation Steps

Use prefix not postfix to increment in a loop

[G-05] For loop incrementing can be unsafe

For loops that use i++ do not need to use safemath for this operation because the loop would run out of gas long before this point. Making this addition operation unsafe using unchecked saves gas.

Sample code to make the for loop increment unsafe

for (uint i = 0; i < length; i = unchecked_inc(i)) {
    // do something that doesn't change the value of i
}

function unchecked_inc(uint i) returns (uint) {
    unchecked {
        return i + 1;
    }
}

Idea borrowed from https://gist.github.com/hrkrshnn/ee8fabd532058307229d65dcd5836ddc#the-increment-in-for-loop-post-condition-can-be-made-unchecked

Recommended Mitigation Steps

Make the increment in for loops unsafe to save gas

[G-06] Add payable to constructors that won't receive ETH

Identifying a constructor as payable saves gas. Constructors should only be called by the admin or deployer and should not mistakenly receive ETH. Constructors can be payable to save gas.

Locations where this was found include https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L61 https://github.com/code-423n4/2022-06-illuminate/blob/main/redeemer/Redeemer.sol#L44 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20Permit.sol#L23 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC5095.sol#L21 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/MarketPlace.sol#L53 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20.sol#L39

Recommended Mitigation Steps

Add payable to these functions for gas savings

[G-07] Use internal function in place of modifier

An internal function can save gas vs. a modifier. A modifier inlines the code of the original function but an internal function does not.

Source https://blog.polymath.network/solidity-tips-and-tricks-to-save-gas-and-reduce-bytecode-size-c44580b218e6#dde7

Locations where this was found include https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L722 https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L731 https://github.com/code-423n4/2022-06-illuminate/blob/main/redeemer/Redeemer.sol#L300 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC5095.sol#L138 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/MarketPlace.sol#L247

Recommended Mitigation Steps

Use internal functions in place of modifiers to save gas.

[G-08] Use type(uint256).max

Using type(uint256).max uses less gas than other options for this constant value. Source https://forum.openzeppelin.com/t/using-the-maximum-integer-in-solidity/3000/13

Locations where this was found include https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L84 https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L112

Recommended Mitigation Steps

Use type(uint256).max

[G-09] Use uint not bool

Booleans are more expensive than uint256 or any type that takes up a full word because each write operation emits an extra SLOAD to first read the slot's contents, replace the bits taken up by the boolean, and then write back. This is the compiler's defense against contract upgrades and pointer aliasing, and it cannot be disabled.

Recommended Mitigation Steps

Replace bool variables with uints

[G-10] Use uint256 not smaller ints

From the solidity docs

When using elements that are smaller than 32 bytes, your contract’s gas usage may be higher. This is because the EVM operates on 32 bytes at a time. Therefore, if the element is smaller than that, the EVM must use more operations in order to reduce the size of the element from 32 bytes to the desired size.

Recommended Mitigation Steps

Replace smaller int or uint variables with uint256 variables

[G-11] Use Solidity errors instead of require

Solidity errors introduced in version 0.8.4 can save gas on revert conditions https://blog.soliditylang.org/2021/04/21/custom-errors/ https://twitter.com/PatrickAlphaC/status/1505197417884528640

Recommended Mitigation Steps

Replace require blocks with new solidity errors described in https://blog.soliditylang.org/2021/04/21/custom-errors/u

[G-12] Write contracts in vyper

The contracts are all written entirely in solidity. Writing contracts with vyper instead of solidity can save gas.

Source https://twitter.com/eiber_david/status/1515737811881807876 doggo demonstrates https://twitter.com/fubuloubu/status/1528179581974417414?t=-hcq_26JFDaHdAQZ-wYxCA&s=19

Recommended Mitigation Steps

Write some or all of the contracts in vyper to save gas

Illuminate contest - 0xkatana's results

Your Sole Source For Fixed-Yields.

General Information

Findings Distribution

Researcher Performance

External Links

[G-05] Gas Report - $147.51

Findings Information

Awards

Labels

External Links

[G-01] Redundant zero initialization

Recommended Mitigation Steps

[G-02] Split up require statements instead of &&

Recommended Mitigation Steps

[G-03] Use != 0 instead of > 0

Recommended Mitigation Steps

[G-04] Use prefix not postfix in loops

Recommended Mitigation Steps

[G-05] For loop incrementing can be unsafe

Recommended Mitigation Steps

[G-06] Add payable to constructors that won't receive ETH

Recommended Mitigation Steps

[G-07] Use internal function in place of modifier

Recommended Mitigation Steps

[G-08] Use type(uint256).max

Recommended Mitigation Steps

[G-09] Use uint not bool

Recommended Mitigation Steps

[G-10] Use uint256 not smaller ints

Recommended Mitigation Steps

[G-11] Use Solidity errors instead of require

Recommended Mitigation Steps

[G-12] Write contracts in vyper

Recommended Mitigation Steps