bunker.finance contest - Cityscape's results

The easiest way to borrow against your NFTs.

General Information

Platform: Code4rena

Start Date: 03/05/2022

Pot Size: $50,000 USDC

Total HM: 4

Participants: 46

Period: 5 days

Judge: gzeon

Total Solo HM: 2

Id: 117

League: ETH

bunker.finance

Findings Distribution

Researcher Performance

Rank: 44/46

Findings: 1

Award: $52.48

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

52.4836 USDC - $52.48

Labels

bug
G (Gas Optimization)

External Links

Gas Optimizations

Unnecessarily initialized Variable

vars.totalAmount = 0;

proposed change:

vars.totalAmount;

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L175

uint256 totalAmount = 0;

proposed change:

uint256 totalAmount;

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L97

uint256 totalAmount = 0

proposed change:

uint256 totalAmount;

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L49


Set Unchanging variables to immutable

address public cEtherAddress;

proposed change:

address public immutable cEtherAddress;

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/PriceOracleImplementation.sol#L11


Use Unchecked Arithmetic


for (uint256 i; i < length; ++i) { 
                    IERC721(underlying).safeTransferFrom(address(this), msg.sender, tokenIds[i], "");
                }

proposed change:

for (uint256 i; i < length;) {
                    IERC721(underlying).safeTransferFrom(address(this), msg.sender, tokenIds[i], "");
                    unchecked{ ++i;}
                }

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L151-L153

for (uint256 i; i < length; ++i) {
                    bytes memory data = abi.encodeWithSignature("transferPunk(address,uint256)", msg.sender, tokenIds[i]);
                    (bool transferPunkSuccess, ) = underlying.call(data);
                    require(transferPunkSuccess, "CNFT: Calling transferPunk was unsuccessful");
                }

proposed change:

for (uint256 i; i < length;) {
                    bytes memory data = abi.encodeWithSignature("transferPunk(address,uint256)", msg.sender, tokenIds[i]);
                    (bool transferPunkSuccess, ) = underlying.call(data);
                    require(transferPunkSuccess, "CNFT: Calling transferPunk was unsuccessful");
                    unchecked{ ++i;}
                }

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L145-L149

for (uint256 i; i < length; ++i) {
            if (!is1155) {
                require(seizeAmounts[i] == 1, "CNFT: Amounts must be all 1s for non-ERC1155s.");
            }
            totalAmount += seizeAmounts[i];
        }

proposed change:

for (uint256 i; i < length) {
            if (!is1155) {
                require(seizeAmounts[i] == 1, "CNFT: Amounts must be all 1s for non-ERC1155s.");
            }
            totalAmount += seizeAmounts[i];
            unchecked{ ++i; }
        }

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L98-L103

for (uint256 i; i < length; ++i) {
                    IERC721(underlying).safeTransferFrom(msg.sender, address(this), tokenIds[i], "");
                }

proposed change:

for (uint256 i; i < length;) {
                    IERC721(underlying).safeTransferFrom(msg.sender, address(this), tokenIds[i], "");
                    unchecked {++i;}
                }

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L72-L73

for (uint256 i; i < length; ++i) {
                    bytes memory punkIndexToAddress = abi.encodeWithSignature("punkIndexToAddress(uint256)", tokenIds[i]);
                    (bool checkSuccess, bytes memory result) = underlying.staticcall(punkIndexToAddress);
                    (address nftOwner) = abi.decode(result, (address));
                    require(checkSuccess && nftOwner == msg.sender, "Not the NFT owner");
                    bytes memory data = abi.encodeWithSignature("buyPunk(uint256)", tokenIds[i]);
                    (bool buyPunkSuccess, ) = underlying.call(data);
                    require(buyPunkSuccess, "CNFT: Calling buyPunk was unsuccessful");
                }

proposed change:

for (uint256 i; i < length;) {
                    bytes memory punkIndexToAddress = abi.encodeWithSignature("punkIndexToAddress(uint256)", tokenIds[i]);
                    (bool checkSuccess, bytes memory result) = underlying.staticcall(punkIndexToAddress);
                    (address nftOwner) = abi.decode(result, (address));
                    require(checkSuccess && nftOwner == msg.sender, "Not the NFT owner");
                    bytes memory data = abi.encodeWithSignature("buyPunk(uint256)", tokenIds[i]);
                    (bool buyPunkSuccess, ) = underlying.call(data);
                    require(buyPunkSuccess, "CNFT: Calling buyPunk was unsuccessful");
                    unchecked { ++i;}
                }

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L62-L70

for (uint256 i; i < length; ++i) {
            if (!is1155) {
                require(amounts[i] == 1, "CNFT: Amounts must be all 1s for non-ERC1155s.");
            }
            totalAmount += amounts[i];
        }

proposed change:

for (uint256 i; i < length;) {
            if (!is1155) {
                require(amounts[i] == 1, "CNFT: Amounts must be all 1s for non-ERC1155s.");
            }
            totalAmount += amounts[i];
            unchecked {++i;} 
        }

https://github.com/bunkerfinance/bunker-protocol/blob/752126094691e7457d08fc62a6a5006df59bd2fe/contracts/CNft.sol#L50-L55


AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter