Yield-Convex contest - Funen's results

Handle

Funen

Vulnerability details

https://github.com/code-423n4/2022-01-yield/blob/main/contracts/ConvexStakingWrapper.sol#L41-L45

curveToken , convexToken , convexpool , collateralVault , convexPoolId comment was used immutable, but actual code not using immutable. immutable can saving more gas

## Recommended Mitigation Steps

    address public curveToken;
    address public convexToken;
    address public convexPool;
    address public collateralVault;
    uint256 public convexPoolId;

changed to

    address public immutable curveToken;
    address public immutable convexToken;
    address public immutable convexPool;
    address public immutable collateralVault;
    uint256 public immutable convexPoolId;

Handle

Funen

Vulnerability details

Impact

Using i++ instead ++i for all the loops, the variable i is incremented using i++. It is known that implementation by using ++i costs less gas per iteration than i++.

##POC

by seen the disscussion here : https://github.com/ethereum/solidity/issues/10695

Occurance

contracts/ConvexStakingWrapper.sol/L115:
contracts/ConvexStakingWrapper.sol/L287:
contracts/ConvexStakingWrapper.sol/L271:
contracts/ConvexStakingWrapper.sol/L315:
contracts/ConvexYieldWrapper.sol/L63:
contracts/ConvexYieldWrapper.sol/L80: contracts/ConvexYieldWrapper.sol/L111:

Handle

Funen

Vulnerability details

Impact

Expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-yield/blob/main/contracts/ConvexStakingWrapper.sol#L52-L55

Declaring 3 bool variable is quite expensive for gas usage. Here the better implementation:

bool private _status = true;
    
    modifier nonReentrant() {
        // On the first call to nonReentrant, _notEntered will be true
        require(_status, "ReentrancyGuard: reentrant call");
        // Any calls to nonReentrant after this point will fail
        _status = false;
        _;
        // By storing the original value once again, a refund is triggered (see
        // https://eips.ethereum.org/EIPS/eip-2200)
        _status = true;
    }
    // save a lot of gas

Handle

Funen

Vulnerability details

https://github.com/code-423n4/2022-01-yield/blob/main/contracts/ConvexStakingWrapper.sol#L94-L95

IERC20(curveToken).approve(convexBooster, 0);
IERC20(curveToken).approve(convexBooster, type(uint256).max);

curveToken was called mutiple times, caching it in memory , it can cost less gas