Platform: Code4rena
Start Date: 04/01/2022
Pot Size: $25,000 USDC
Total HM: 3
Participants: 40
Period: 3 days
Judge: Ivo Georgiev
Total Solo HM: 1
Id: 75
League: ETH
Rank: 23/40
Findings: 2
Award: $77.58
🌟 Selected for report: 0
🚀 Solo Findings: 0
37.3718 USDC - $37.37
Jujic
There are two input arrays, but no check for the same length.
function setLockPeriods(uint256[] memory durations_, uint8[] memory multipliers) external onlyOwner { uint256 count = durations_.length; for (uint256 i; i < count; ++i) { uint256 duration = durations_[i]; require(duration <= uint256(18250 days), "INVALID_DURATION"); emit LockPeriodSet(duration, bonusMultiplierOf[duration] = multipliers[i]); } }
Remix
Check the length of both input arrays.
require(durations_.length == multipliers.length);
#0 - deluca-mike
2022-01-08T03:33:32Z
There is no transfer here, so maybe the title is wrong.
In any case, if there are more multipliers than durations, then the extra multipliers are ignored. If there are more durations than multipliers, then the function will revert anyway. Further, if the admin did make a mistake, they can just call the function again. This is no-risk.
#1 - deluca-mike
2022-01-09T10:58:44Z
Duplicate #38
13.1525 USDC - $13.15
Jujic
Using the unchecked keyword to avoid redundant arithmetic underflow/overflow checks to save gas when an underflow/overflow cannot happen.
require(lockAmount_ <= amountUnlocked_, "INSUFFICIENT_AMOUNT_UNLOCKED"); uint256 withdrawAmount = amountUnlocked_ - lockAmount_;
Remix
unchecked { uint256 withdrawAmount = amountUnlocked_ - lockAmount_; }
#0 - deluca-mike
2022-01-08T03:36:08Z
While we originally did not want to use unchecked math, even if we knew it saved gas, in order to have cleaner code, we will now use unchecked math everywhere possible.
#1 - deluca-mike
2022-01-09T10:57:44Z
Duplicate #49
27.0627 USDC - $27.06
Jujic
!= 0 is a cheaper operation compared to > 0, when dealing with uint.
require(totalUnitsCached > uint256(0), "NO_UNIT_SUPPLY");
Remix
#0 - deluca-mike
2022-01-08T03:37:05Z
This is not always true, but still valid point that it is worth testing and checking. In any case, requires will be converted into if-reverts with custom error messages to that will now become: if (totalUnitsCached == uint256(0)) revert NoUnitSupply();
#1 - deluca-mike
2022-01-09T10:57:25Z
Duplicate #88