Canto v2 contest - JC's results

Execution layer for original work.

General Information

Platform: Code4rena

Start Date: 28/06/2022

Pot Size: $25,000 USDC

Total HM: 14

Participants: 50

Period: 4 days

Judge: GalloDaSballo

Total Solo HM: 7

Id: 141

League: ETH

Canto

Findings Distribution

Researcher Performance

Rank: 26/50

Findings: 2

Award: $65.97

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository Canto

Findings Information

🌟 Selected for report: zzzitron

Also found by: 0v3rf10w, 0x1f8b, 0x29A, AlleyCat, Bnke0x0, Chom, Funen, JC, Lambda, Limbooo, Meera, Picodes, Sm4rty, TerrierLover, TomJ, __141345__, asutorufos, aysha, c3phas, cccz, defsec, fatherOfBlocks, grGred, hake, ignacio, ladboy233, mrpathfindr, oyc_109, rfa, sach1r0, samruna, slywaters, ynnad

Awards

44.1741 USDC - $44.17

Labels

bug

QA (Quality Assurance)

External Links

Link to GitHub issue

[N-01] Use a more recent version of solidity Use a solidity version of at least 0.8.12 to get string.concat() to be used instead of abi.encodePacked(<str>,<str>)

[N-02] Lock pragmas to specific compiler version Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively. see https://swcregistry.io/docs/SWC-103

[N-03] Namings are not appropriate (1 letter)

[N-04] Use of sensitive/non-inclusive terms

Instances include: https://github.com/Plex-Engineer/manifest-v2/blob/f6ebfe679973edf4f64832e64480ff5250ef8486/contracts/Proposal-Store.sol#L6

Mitigation: change 'evil' to 'unfriendly'

[L-01] abi.encodePacked should not be used with dynamic types when passing the result to a hash function such as keccak256()

Mitigation: Use abi.encode() instead which will pad items to 32 bytes, which will prevent hash collisions (e.g. abi.encodePacked(0x123,0x456) => 0x123456 => abi.encodePacked(0x1,0x23456), but abi.encode(0x123,0x456) => 0x0...1230...456). “Unless there is a compelling reason, abi.encode should be preferred”. https://docs.soliditylang.org/en/v0.8.13/abi-spec.html#non-standard-packed-mode (in 'warning')

[L-02] require() should be used instead of assert()

Instances include: https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Stableswap/BaseV1-periphery.sol#L100 https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Stableswap/BaseV1-periphery.sol#L245 https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Stableswap/BaseV1-periphery.sol#L291 https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Stableswap/BaseV1-periphery.sol#L437 https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Comptroller.sol#L219 https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Comptroller.sol#L365

#0 - GalloDaSballo
2022-08-13T22:39:19Z

[L-01] abi.encodePacked

Disputed, you must have a risk of clash for this finding to be valid. The day you find a clash, submit as higher severity

[L-02] require() should be used instead of assert()

Valid Low

#1 - GalloDaSballo
2022-08-13T22:41:50Z

[N-01] Use a more recent version of solidity

[N-02] Lock pragmas to specific compiler version

[N-03] Namings are not appropriate (1 letter)

Disagree given the widespread terminology for signature parts

[N-04] Use of sensitive/non-inclusive terms

Disputed, evil is perfectly adequate as a word (the fact the comment exists is technically a mistake, but that seems to have been missed), that said, thank you for the chuckle

#2 - GalloDaSballo
2022-08-13T22:41:57Z

1L 2NC

Findings Information

🌟 Selected for report: 0x1f8b

Also found by: 0x29A, 0xArshia, 0xKitsune, Bnke0x0, Chom, Fitraldys, Funen, JC, Lambda, Meera, Noah3o6, Picodes, RedOneN, Rohan16, Sm4rty, TerrierLover, TomJ, Tomio, Waze, ajtra, c3phas, cRat1st0s, defsec, durianSausage, fatherOfBlocks, grGred, hake, ladboy233, m_Rassska, mrpathfindr, oyc_109, rfa, ynnad

Awards

21.8032 USDC - $21.80

Labels

bug

G (Gas Optimization)

External Links

Link to GitHub issue

[G-01] ++i costs less gas than i++, especially when it's used in for loops (same for ++j vs j++)

[G-02] Use nested multiple require instead of && operator Require statements including conditions with the && operator can be broken down in multiple require statements to save gas.

Mitigation: Breakdown each condition in a separate require statement (though require statements should be replaced with custom errors).

[G-03] Use nested multiple if instead of && operator If statements including conditions with the && operator can be broken down in multiple if statements to save gas.

[G-04] custom errors Custom errors from Solidity 0.8.4 are cheaper than revert strings (cheaper deployment cost and runtime cost when the revert condition is met) while providing the same amount of information, as explained here https://blog.soliditylang.org/2021/04/21/custom-errors/ Custom errors are defined using the error statement

Mitigation: Replace require statements with custom errors.

[G-05] Comparison operators In the EVM, there is no opcode for >= or <=. When using greater than or equal, two operations are performed: > and =. Using strict comparison operators hence saves gas.

Mitigation: Replace <= with <, and >= with >. Do not forget to increment/decrement the compared variable.

[G-06] Reduce the size of error messages (Long revert Strings) Shortening revert strings to fit in 32 bytes will decrease deployment time gas and will decrease runtime gas when the revert condition is met. Revert strings that are longer than 32 bytes require at least one additional mstore, along with additional overhead for computing memory offset, etc.

Mitigation: I suggest shortening the revert strings to fit in 32 bytes

[G-07] public functions not called by the contract should be declared external instead https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Accountant/AccountantInterfaces.sol#L37 https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Treasury/TreasuryDelegate.sol#L19 https://github.com/Plex-Engineer/lending-market-v2/blob/443a8c0fed3c5018e95f3881a31b81a555c42b2d/contracts/Treasury/TreasuryInterfaces.sol#L25

#0 - GalloDaSballo
2022-08-14T20:49:30Z

Less than 100 gas saved

Canto v2 contest - JC's results

Execution layer for original work.

General Information

Findings Distribution

Researcher Performance

External Links

[Q-18] QA Report - $44.17

Findings Information

Awards

Labels

External Links

#0 - GalloDaSballo2022-08-13T22:39:19Z

[L-01] abi.encodePacked

[L-02] require() should be used instead of assert()

#1 - GalloDaSballo2022-08-13T22:41:50Z

[N-01] Use a more recent version of solidity

[N-02] Lock pragmas to specific compiler version

[N-03] Namings are not appropriate (1 letter)

[N-04] Use of sensitive/non-inclusive terms

#2 - GalloDaSballo2022-08-13T22:41:57Z

[G-19] Gas Report - $21.80

Findings Information

Awards

Labels

External Links

#0 - GalloDaSballo2022-08-14T20:49:30Z

#0 - GalloDaSballo
2022-08-13T22:39:19Z

#1 - GalloDaSballo
2022-08-13T22:41:50Z

#2 - GalloDaSballo
2022-08-13T22:41:57Z

#0 - GalloDaSballo
2022-08-14T20:49:30Z