JPEG'd contest - Funen's results

1. Missing Emit Event

https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/tokens/StableCoin.sol#L32

there was no emit transfer event was used here

##Tool Used Manual Review

##POC https://github.com/OpenZeppelin/openzeppelin-contracts/blob/7392d8373873bed5da9ac9a97811d709f8c5ffbb/contracts/token/ERC20/ERC20.sol#L248-L266

##Recommended Mitigation Remove it or change it

2. Unmatch comment with actual code

https://github.com/code-423n4/2022-04-jpegd/blob/e72861a9ccb707ced9015166fbded5c97c6991b6/contracts/tokens/StableCoin.sol#L29 https://github.com/code-423n4/2022-04-jpegd/blob/e72861a9ccb707ced9015166fbded5c97c6991b6/contracts/tokens/StableCoin.sol#L36

since account can be changed by to and no require account can't be zero address it can be changed by using must have minter role to mint

##Tool Used Manual Review

#POC https://github.com/OpenZeppelin/openzeppelin-contracts/blob/7392d8373873bed5da9ac9a97811d709f8c5ffbb/contracts/token/ERC20/ERC20.sol#L248-L266

##Recommended Mitigation Change it.

3. nocontract can be bypassable

https://github.com/code-423n4/2022-04-jpegd/blob/e72861a9ccb707ced9015166fbded5c97c6991b6/contracts/farming/LPFarming.sol#L85-L91

since is.contract() check ext.sizecode so it can being able to bypass this check it would be better using logical, msg.sender != tx.origins.

##Tool Used Manual Review

##POC https://solidity-by-example.org/hacks/contract-size/ https://ethereum.stackexchange.com/questions/1891/whats-the-difference-between-msg-sender-and-tx-origin

1. Change using > instead of!= for saving more gas

https://github.com/code-423n4/2022-04-jpegd/blob/e72861a9ccb707ced9015166fbded5c97c6991b6/contracts/farming/LPFarming.sol#L193

using > can be saving more gas

##Tool Used Remix

##Recommendation Mitigation Change it into !=

2. Unnecessary code

https://github.com/code-423n4/2022-04-jpegd/blob/e72861a9ccb707ced9015166fbded5c97c6991b6/contracts/staking/JPEGStaking.sol#L50

this can be deleted to saving more gas since it unnecessary and it can be bug if can be burn amount more than msg.sender had.

##Tool Used Manual Review & Remix

3. using ++i than i++ for saving more gas

Using i++ instead ++i for all the loops, the variable i is incremented using i++. It is known that implementation by using ++i costs less gas per iteration than i++.

Tools Used

Remix

Occurances

main/contracts/farming/LPFarming.sol#L348
main/contracts/vaults/yVault/strategies/StrategyPUSDConvex.sol#L145
main/contracts/vaults/yVault/strategies/StrategyPUSDConvex.sol#L231
main/contracts/vaults/yVault/strategies/StrategyPUSDConvex.sol#L319

4. change uint256 i = 0 into uint i for saving more gas

this implementation can saving more gas for each loops.

##Tool Used Manual Review & Remix

##Recommended Mitigation Change it

Occurances

main/contracts/farming/LPFarming.sol#L348
main/contracts/vaults/yVault/strategies/StrategyPUSDConvex.sol#L145
main/contracts/vaults/yVault/strategies/StrategyPUSDConvex.sol#L231
main/contracts/vaults/yVault/strategies/StrategyPUSDConvex.sol#L319

5. Caching array length can saving more gas

this implementation can be saving more gas, since if caching the array length is more gas efficient. This is because access to a local variable in solidity is more efficient.

##Tool Used Manual Review

##Occurances

main/contracts/farming/LPFarming.sol#L348
main/contracts/vaults/yVault/strategies/StrategyPUSDConvex.sol#L145
main/contracts/vaults/yVault/strategies/StrategyPUSDConvex.sol#L231
main/contracts/vaults/yVault/strategies/StrategyPUSDConvex.sol#L319

6. Saving gas by removing = 0

If a variable was not set/initialized, it is assumed to have default value to 0 this implementation was used for saving more gas by removing = 0

##POC https://blog.polymath.network/solidity-tips-and-tricks-to-save-gas-and-reduce-bytecode-size-c44580b218e6

##TOOLS USED Remix, Manual Review

##Mitigation Step Remove = 0

##Occurances

contracts/farming/LPFarming.sol#L340
contracts/farming/LPFarming.sol#L357