Golom contest - 0xmatt's results

CodeArena QA Report

Vulnerability detail - Duplicate Code

Impact

The validateOrder() function in GolomTrader.sol checks twice that the recovered signature signer is o.signer.

Details/Proof-Of-Concept

The following code is encountered from L177 of GolomTrader.sol:

require(signaturesigner == o.signer, 'invalid signature');
if (signaturesigner != o.signer) {
    return (0, hashStruct, 0);
}

The require() statement ensures that the following condition is never met. If signaturesigner and o.signer don't match the transaction will revert with an 'invalid signature' error instead of returning a status code of 0.

Suggested Mitigation Steps

Remove the if statement from L178-L180.

Tools Used

Saw it reading in VSCode

CodeArena Gas Optimization Report

Vulnerability detail - Unnecessary Zero Variable Assignment At Initialization

Impact

Uninitialized variables are assigned zero values by default (with the exception of Strings). Assigning a zero value to a variable costs gas. Gas can saved by eliminating unnecessary zero-assignments.

Details/Proof-Of-Concept

In the function _checkPoint() in vote-escrow/VoteEscrowCore.sol the old_dslope and new_dslope int128 values are declared and initialized with a value of 0. As the default value for int128 is 0 there's no benefit in assigning values of 0 to these variables at initialization.

The zero-assignment can also be removed from loops starting at zero. Different compiler configurations will have different impacts on gas savings.

Suggested Mitigation Steps

Remove the '= 0' assignment. As an example change the assignment at lines 697 and 698 of VoteEscoreCore.sol:

    int128 old_dslope = 0;
    int128 new_dslope = 0;

To:

    int128 old_dslope;
    int128 new_dslope;

Instances Found

In contracts/vote-escrow/vote-escrow/VoteEscrowDelegation.sol:

Static assignments:

1. L50
2. L147
3. L170
4. L188

Loops:

1. L171
2. L189

In contracts/rewards/rewards/RewardDistributor.sol:

Static assignments:

1. L45
2. L142
3. L156
4. L175
5. L176
6. L222
7. L223
8. L257
9. L272

Loops:

1. L143
2. L157
3. L180
4. L183
5. L226
6. L258
7. L273

In contracts/vote-escrow/vote-escrow/VoteEscrowCore.sol:

Static assignments:

1. L697
2. L698
3. L735
4. L749
5. L1042
6. L1113
7. L1133
8. L1134
9. L1169
10. L1211

Loops:

1. L745
2. L1044
3. L1115
4. L1167

In contracts/core/GolomTrader.sol:

Loops:

1. L415

Tools Used:

Grep.