Yield Witch v2 contest - Chom's results

Underflow risk of elapsed = uint32(block.timestamp) - uint256(auction_.start);

https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L581-L583

        unchecked {
            elapsed = uint32(block.timestamp) - uint256(auction_.start); // Overflow on block.timestamp is fine
        }

if uint256(auction_.start) > uint32(block.timestamp), elapsed will be underflow.

You should use larger than uint32 to store timestamp

type(uint32).max = 4294967295 which is Sunday, February 7, 2106 6:28:15

This mean that if you use uint32 to store timestamp, your program only work until Sunday, February 7, 2106 6:28:15 and there aren't any idea proposed on how to migrate beyond that date.

Consider using custom errors instead of revert strings

This reduce gas cost as show here https://forum.openzeppelin.com/t/a-collection-of-gas-optimisation-tricks/19966/5

Solidity 0.8.4 introduced custom errors. They are more gas efficient than revert strings, when it comes to deployment cost as well as runtime cost when the revert condition is met. Use custom errors instead of revert strings for gas savings.

Any require statement in your code can be replaced with custom error for example,

https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L395

require(ilkJoin != IJoin(address(0)), "Join not found");

Can be replaced with

// declare error before contract declaration
error JoinNotFound();

if (ilkJoin != IJoin(address(0)) revert JoinNotFound();