Forgotten Runes Warrior Guild contest - M0ndoHEHE's results

16,000 Warrior NFTs sold in a phased Dutch Auction.

General Information

Platform: Code4rena

Start Date: 03/05/2022

Pot Size: $30,000 USDC

Total HM: 6

Participants: 93

Period: 3 days

Judge: gzeon

Id: 118

League: ETH

Forgotten Runes

Findings Distribution

Researcher Performance

Rank: 72/93

Findings: 2

Award: $45.73

🌟 Selected for report: 0

🚀 Solo Findings: 0

Free Minting in some conditions

Issue

selfRefundsStartTime can be set by the owner using the function setSelfRefundsStartTime. if the self refund is enabled during the bidSummon phase, it would be possible to mint using bidSummon and subsequentely call selfRefund to get full mint price refund.

Resolution

do not enable self refund when bidSummon phase is in place.

Unnecessary uint size for timestamps

Timestamps used in ForgottenRunesWarriorsMinter.sol (daStartTime, mintlistStartTime, publicStartTime) don't require uint256, so it could be save some gas while performing operations using smaller storage types like uint32 or uint64.

Example ForgottenRunesWarriorsMinter.sol Line 17:

uint32 public daStartTime = 0xffffffff; /// @notice The start timestamp for mintlisters /// @dev This is the end of DA phase. No more DA bids when this is hit uint32 public mintlistStartTime = 0xffffffff; /// @notice The start timestamp for the public sale uint32 public publicStartTime = 0xffffffff;

Long Revert String

If it possible to compile contracts with solc >=0.8.4 consider using Custom Errors as they are more gas efficient while allowing developers to describe the error in detail using NatSpec or error codes.

References from Uniswap

Unnecessary checked arithmetic in for loop

Since there is no risk for overflow, it is possible to use "unchecked {}" blocks to increment round variables. Example ForgottenRunesWarriorsMinter.sol Line 162:

/* it is safe to rewrite as */ for (uint256 i = 0; i < numWarriors; ) { _mint(msg.sender); unchecked { i++; } }

same for the other for loops:

  • ForgottenRunesWarriorsMinter.sol line 220
  • ForgottenRunesWarriorsMinter.sol line 259
  • ForgottenRunesWarriorsMinter.sol line 355
AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter