Golom contest - CodingNameKiki's results

An NFT marketplace that offers the lowest industry fee, a publicly available order-book along with analytical tools.

General Information

Platform: Code4rena

Start Date: 26/07/2022

Pot Size: $75,000 USDC

Total HM: 29

Participants: 179

Period: 6 days

Judge: LSDan

Total Solo HM: 6

Id: 148

League: ETH

Golom

Findings Distribution

Researcher Performance

Rank: 161/179

Findings: 1

Award: $21.32

🌟 Selected for report: 0

🚀 Solo Findings: 0

  1. Using > 0 cost more gas than != 0 when used on a uint in require() statement

VoteEscrowCore.sol 997: require(_locked.amount > 0, 'Nothing is locked'); 982: require(_locked.amount > 0, 'No existing lock found'); 944: require(_value > 0); 928: require(_locked.amount > 0, 'No existing lock found'); 927: require(_value > 0);

  1. Multiple address mapping can be combined into a single mapping of an address to a struct, where appropriate

RewardDistributor.sol 58: mapping(address => mapping(uint256 => uint256)) public feesTrader; 59: mapping(address => mapping(uint256 => uint256)) public feesExchange;

  1. Splitting require() statements that use && saves gas

VoteEscrowDelegation.sol 239: require(attachments[_tokenId] == 0 && !voted[_tokenId], 'attached');

  1. Internal functions only called ones can be inlined to save gas

VoteEscrowDelegation.sol 116: function _getCurrentDelegated(uint256 tokenId) internal view returns (uint256[] memory) { 129: function _getPriorDelegated(uint256 nftId, uint256 blockNumber) internal view returns (uint256[] memory) { 198: function removeElement(uint256[] storage _array, uint256 _element) internal {

  1. Using bools for storage incurs overhead

GolomToken.sol 20: bool public isAirdropMinted; 21: bool public isGenesisRewardMinted

  1. Internal functions only called once can be inlined to save gas

VoteEscrowCore.sol 452: function _addTokenToOwnerList(address _to, uint256 _tokenId) internal { 462: function _removeTokenFromOwnerList(address _from, uint256 _tokenId) internal { 517: function _clearApproval(address _owner, uint256 _tokenId) internal { 677: function _mint(address _to, uint256 _tokenId) internal returns (bool) {

  1. Splitting require() statements that use && saves gas

VoteEscrowCore.sol 538: require(attachments[_tokenId] == 0 && !voted[_tokenId], 'attached'); 894: require(attachments[_from] == 0 && !voted[_from], 'attached'); 1008: require(attachments[_tokenId] == 0 && !voted[_tokenId], 'attached');

  1. Multiple address mapping can be combined into a single mapping of an address to a struct, where appropriate

VoteEscrowCore.sol 332: mapping(address => uint256) internal ownerToNFTokenCount; 335: mapping(address => mapping(uint256 => uint256)) internal ownerToNFTokenIdList; 341: mapping(address => mapping(address => bool)) internal ownerToOperators;

  1. Using bools for storage incurs overhead

VoteEscrowCore.sol 314: mapping(uint256 => bool) public voted; 341: mapping(address => mapping(address => bool)) internal ownerToOperators; 344: mapping(bytes4 => bool) internal supportedInterfaces;

  1. State variables only set in the constructor should be declared immutable

VoteEscrowCore.sol 300: address public token; 315: address public voter;

  1. Not using the named return variables when a fuction returns, wastes deployment gas

VoteEscrowCore.sol 1067: return 0; 1152: return 0;

  1. Using private rather than public for constants, saves gas

VoteEscrowCore.sol 317: string public constant name = 'veNFT'; 318: string public constant symbol = 'veNFT'; 319: string public constant version = '1.0.0'; 320: uint8 public constant decimals = 18;

  1. It costs more gas to initialize variables to zero than to let the default of zero be applied

VoteEscrowCore.sol 745: for (uint256 i = 0; i < 255; ++i) { 1044: for (uint256 i = 0; i < 128; ++i) { 1115: for (uint256 i = 0; i < 128; ++i) { 1167: for (uint256 i = 0; i < 255; ++i) {

  1. It cost more gas to initiliaze variables to zero than to let the default of zero be applied

GolomTrader.sol 415: for (uint256 i = 0; i < proof.length; i++) {

  1. Functions guaranted to revert when called by normal users can be marked payable

GolomTrader.sol 444: function setDistributor(address _distributor) external onlyOwner { 454: function executeSetDistributor() external onlyOwner {

  1. Functions guaranted to revert when called by normal users can be marked payable

RewardDistributor.sol 285: function changeTrader(address _trader) external onlyOwner { 291: function executeChangeTrader() external onlyOwner { 298: function addVoteEscrow(address _voteEscrow) external onlyOwner { 308: function executeAddVoteEscrow() external onlyOwner {

  1. It costs more gas to initalize variables to zero than to let the default of zero be applied

RewardDistributor.sol 143: for (uint256 index = 0; index < epochs.length; index++) { 157: for (uint256 index = 0; index < epochs.length; index++) { 180: for (uint256 tindex = 0; tindex < tokenids.length; tindex++) { 183: for (uint256 index = 0; index < epochs.length; index++) { 226: for (uint256 index = 0; index < epoch; index++) { 258: for (uint256 index = 0; index < epoch; index++) { 273: for (uint256 index = 0; index < epoch; index++) {

  1. Empty blocks should be removed or emit something

RewardDistributor.sol 313: fallback() external payable {} 315: receive() external payable {}

  1. It cost more gas to initalize variables to zero than to let the default of zero be applied

VoteEscrowDelegation.sol 171: for (uint256 index = 0; index < delegated.length; index++) { 189: for (uint256 index = 0; index < delegatednft.length; index++) {

  1. Functions guaranted to revert when called by normal users can be marked payable

VoteEscrowDelegation.sol 260: function changeMinVotingPower(uint256 _newMinVotingPower) external onlyOwner {

  1. Functions guaranted to revert when called by normal users can be marked payable

GolomToken.sol 42: function mintAirdrop(address _airdrop) external onlyOwner { 50: function mintGenesisReward(address _rewardDistributor) external onlyOwner { 58: function setMinter(address _minter) external onlyOwner { 65: function executeSetMinter() external onlyOwner {

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter