Alchemix contest - MaratCerby's results

A protocol for self-repaying loans with no liquidation risk.

General Information

Platform: Code4rena

Start Date: 05/05/2022

Pot Size: $125,000 DAI

Total HM: 17

Participants: 62

Period: 14 days

Judge: leastwood

Total Solo HM: 15

Id: 120

League: ETH

Alchemix

Findings Distribution

Researcher Performance

Rank: 28/62

Findings: 2

Award: $278.33

🌟 Selected for report: 0

🚀 Solo Findings: 0

Please consider previous QA submission invalid

Impact

[1] These two mappings can be combined into a single mapping(address => WhitelistStatus) Where WhitelistStatus is a struct combining paused and whitelisted booleans. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemicTokenV2.sol#L32-L36

Proof of Concept

Tools Used


Impact

[2] Consider moving this line closer to the usage. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemicTokenV2.sol#L215
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemicTokenV2.sol#L215
  3. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/gALCX.sol#L56

Proof of Concept

Tools Used


Impact

[3] Success variable is unused, consider removing it. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/gALCX.sol#L63

Proof of Concept

Tools Used


Impact

[4] Consider using the Checks-Effects-Interactions pattern. Emitting event should be after the deposit. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/gALCX.sol#L77

Proof of Concept

Tools Used


Impact

[5] The value of 'activeBalance' is effectively zero. Consider using return 0; instead. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemistV2.sol#L1560

Proof of Concept

Tools Used


Impact

[6] Should not these functions retun zero if total shares are zero? Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemistV2.sol#L1609
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemistV2.sol#L1623

Proof of Concept

Tools Used


Impact

[7] This function is not needed and should be removed. There is not much sense wrapping addition or substraction. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemistV2.sol#L1740
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemistV2.sol#L1750

Proof of Concept

Tools Used


Impact

[8] The type of 'newTransmuter' argument should be ITransmuterV2 interface. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L221
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L265

Proof of Concept

Tools Used


Impact

[9] The type of '_alchemist' argument should be IAlchemistV2 interface. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L230

Proof of Concept

Tools Used


Impact

[10] Consider removing 'nonReentrant' because re-entrancy attack vector is not applicable here. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterV2.sol#L221
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterV2.sol#L250

Proof of Concept

Tools Used


Impact

[11] Consider to use a single power i.e. 10**(18-decimals). Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/libraries/LiquidityMath.sol#L41
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/libraries/LiquidityMath.sol#L46

Proof of Concept

Tools Used


Impact

[12] Magic number, consider using named constant instead. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L520
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L520

Proof of Concept

Tools Used


Impact

[13] Consider using "_" separate digit capacity i.e "100000" could be replaced to "100_000". This increases code readability.

Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemicTokenV2.sol#L30
  2. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L46
  3. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L520
  4. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/yearn/YearnTokenAdapter.sol#L13
  5. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/Limiters.sol#L12

Proof of Concept

Tools Used


Impact

[14] Consider using IERC20 type instead of address. Or IERC20[] type instead of address[].

Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemicTokenV2.sol#L173
  2. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemicTokenV2.sol#L186
  3. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemicTokenV2.sol#L203
  4. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L57
  5. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L113
  6. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L118
  7. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L133
  8. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L138
  9. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L159
  10. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L180
  11. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L189
  12. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L197
  13. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L221
  14. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L238
  15. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L317
  16. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L350
  17. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L391
  18. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L399
  19. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L407
  20. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L416
  21. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L464
  22. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L473
  23. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L484
  24. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L492
  25. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L503
  26. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L515
  27. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L538
  28. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L554
  29. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L573
  30. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L591
  31. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L611
  32. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L634
  33. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L655
  34. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L743
  35. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L804
  36. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L813
  37. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L887
  38. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L908
  39. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L928
  40. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1002
  41. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1025
  42. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1034
  43. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1045
  44. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1056
  45. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1081
  46. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1099
  47. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1106
  48. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1153
  49. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1223
  50. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1243
  51. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1258
  52. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1290
  53. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1310
  54. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1317
  55. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1337
  56. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1364
  57. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1417
  58. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1429
  59. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1462
  60. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1463
  61. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1484
  62. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1504
  63. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1525
  64. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1555
  65. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1582
  66. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1607
  67. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1620
  68. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1634
  69. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1645
  70. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1657
  71. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1669
  72. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1680
  73. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1694
  74. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AutoleverageCurveFactoryethpool.sol#L20
  75. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AutoleverageCurveFactoryethpool.sol#L37
  76. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AutoleverageCurveMetapool.sol#L14
  77. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AutoleverageCurveMetapool.sol#L23
  78. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/CrossChainCanonicalAlchemicTokenV2.sol#L11
  79. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/CrossChainCanonicalGALCX.sol#L10
  80. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/EthAssetManager.sol#L509
  81. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/EthAssetManager.sol#L535
  82. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/ThreePoolAssetManager.sol#L730
  83. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/ThreePoolAssetManager.sol#L737
  84. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L64
  85. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L84
  86. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L130
  87. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L130
  88. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L140
  89. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L165
  90. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L179
  91. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L180
  92. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L187
  93. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L197
  94. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L221
  95. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L251
  96. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L257
  97. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L264
  98. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L289
  99. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L301
  100. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L327
  101. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L332
  102. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L342
  103. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L363
  104. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L372
  105. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L374
  106. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L388
  107. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L412
  108. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L438
  109. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L454
  110. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L473
  111. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L480
  112. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L490
  113. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L498
  114. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L511
  115. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L529
  116. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L566
  117. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterConduit.sol#L13
  118. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterV2.sol#L108
  119. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterV2.sol#L111
  120. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterV2.sol#L144
  121. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterV2.sol#L145
  122. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/WETHGateway.sol#L42
  123. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/WETHGateway.sol#L58
  124. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/fuse/FuseTokenAdapterV1.sol#L24
  125. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/fuse/FuseTokenAdapterV1.sol#L25
  126. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/fuse/FuseTokenAdapterV1.sol#L32
  127. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/fuse/FuseTokenAdapterV1.sol#L33
  128. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/lido/WstETHAdapterV1.sol#L19
  129. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/lido/WstETHAdapterV1.sol#L20
  130. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/lido/WstETHAdapterV1.sol#L21
  131. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/lido/WstETHAdapterV1.sol#L32
  132. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/lido/WstETHAdapterV1.sol#L33
  133. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/lido/WstETHAdapterV1.sol#L34
  134. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/rocket/RETHAdapterV1.sol#L25
  135. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/rocket/RETHAdapterV1.sol#L26
  136. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/rocket/RETHAdapterV1.sol#L35
  137. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/rocket/RETHAdapterV1.sol#L36
  138. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/vesper/VesperAdapterV1.sol#L24
  139. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/vesper/VesperAdapterV1.sol#L25
  140. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/vesper/VesperAdapterV1.sol#L33
  141. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/vesper/VesperAdapterV1.sol#L34
  142. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/yearn/YearnTokenAdapter.sol#L16
  143. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/yearn/YearnTokenAdapter.sol#L17
  144. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/interfaces/ITransmuterBuffer.sol#L23
  145. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/interfaces/transmuter/ITransmuterBuffer.sol#L27
  146. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/TokenUtils.sol#L26
  147. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/TokenUtils.sol#L46
  148. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/TokenUtils.sol#L65
  149. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/TokenUtils.sol#L82
  150. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/TokenUtils.sol#L100
  151. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/TokenUtils.sol#L117
  152. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/TokenUtils.sol#L133
  153. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/TokenUtils.sol#L150

Proof of Concept

Tools Used


Impact

[15] Uint8-256 / Int8-256 is assigned to zero by default, additional reassignment to zero is unnecessary.

Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1458
  2. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/EthAssetManager.sol#L566
  3. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/ThreePoolAssetManager.sol#L901
  4. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L534
  5. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L549
  6. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/adapters/fuse/FuseTokenAdapterV1.sol#L36

Proof of Concept

Tools Used


Impact

[16] It is recommended to explicitly specify uint256 type instead of uint type for better readability.

Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemicTokenV2.sol#L164
  2. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L14
  3. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L15
  4. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L16
  5. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L19
  6. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L20
  7. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L21
  8. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L46
  9. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L50
  10. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L56
  11. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L73
  12. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L85
  13. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L93
  14. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L100
  15. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L102

Proof of Concept

Tools Used

#0 - 0xleastwood

2022-06-09T22:42:32Z

I believe most if not all of these are non-critical

Please consider previous Gas submission invalid

Impact

[1] Consider using optimized for-loop and apply the following optimizations:

  1. cache <array>.length into local variable to avoid looking up every for-loop iteration.
  2. using ++i consumes 5 less gas than i++
  3. using unchecked keyword for counter i unchecked{ ++i; } consumes 49 less gas each iteration
  4. don't initialize uint256 i = 0; instead use the default value uint256 i;

Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L990
  2. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1282
  3. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1355
  4. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1461
  5. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1524
  6. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/EthAssetManager.sol#L214
  7. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/EthAssetManager.sol#L567
  8. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/StakingPools.sol#L188
  9. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/StakingPools.sol#L363
  10. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/ThreePoolAssetManager.sol#L250
  11. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/ThreePoolAssetManager.sol#L254
  12. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/ThreePoolAssetManager.sol#L353
  13. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/ThreePoolAssetManager.sol#L773
  14. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/ThreePoolAssetManager.sol#L902
  15. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L172
  16. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L186
  17. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L235
  18. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L242
  19. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L272
  20. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L382
  21. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L387
  22. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L479

Proof of Concept

Tools Used


Impact

[2] Using x != 0 uses 6 less gas than x > 0. Consider changing all "greater than zero" comparisons to "not equal to zero".

Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L353
  2. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L466
  3. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L678
  4. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L692
  5. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L707
  6. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L746
  7. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L810
  8. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L846
  9. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1103
  10. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1267
  11. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AlchemistV2.sol#L1531
  12. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AutoleverageCurveFactoryethpool.sol#L22
  13. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/AutoleverageCurveMetapool.sol#L15
  14. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L521
  15. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L544
  16. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterBuffer.sol#L556
  17. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterV2.sol#L342
  18. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterV2.sol#L409
  19. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterV2.sol#L417
  20. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterV2.sol#L459
  21. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/TransmuterV2.sol#L460
  22. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L75

Proof of Concept

Tools Used


Impact

[3] The power of 10 numbers such as "10**18" could be rendered as "1e18".

Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/LiquidityMath.sol#L41
  2. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/libraries/LiquidityMath.sol#L46

Proof of Concept

Tools Used


Impact

[4] As per 0.8.4 solidity version it supports new custom errors. Custom errors are reducing 38 gas if condition is met and 22 gas otherwise. Also reduces contract size and deployment costs.

Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/StakingPools.sol#L106
  2. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/StakingPools.sol#L114
  3. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/StakingPools.sol#L124
  4. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/StakingPools.sol#L131
  5. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/StakingPools.sol#L160
  6. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/StakingPools.sol#L183
  7. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L33
  8. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L90
  9. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/gALCX.sol#L107
  10. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/test/TestSets.sol#L15
  11. https://github.com/code-423n4/2022-05-alchemix/blob/main/contracts-full/test/TestSets.sol#L19

Proof of Concept

Tools Used


Impact

[5] Storage keyword is recommended to be used whenever possible. It can save up-to 2k gas per each variable with memory keyword (if updating storage up-to 5-10k). Memory keyword is supposed to be used when temporary data is being updated and calculated regularly. Also recommending reduce IF nesting. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemistV2.sol#L1227
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemistV2.sol#L1244

Proof of Concept

https://geeksforgeeks.org/storage-vs-memory-in-solidity

Tools Used


Impact

[6] Consider simplifying struct by combining several mappings into a single one. mapping(address => TokenSettings) This could save at least numOfMappings x 25k gas on each unique record stored. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/AlchemistV2.sol#L29-L43
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L51-L58

Proof of Concept

Tools Used


Impact

[7] Storage is being updated on each iteration. Consider using temp variable to store total weights and update after the loop. This may save gas 5000 * numberOfIterations. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L207

Proof of Concept

https://geeksforgeeks.org/storage-vs-memory-in-solidity

Tools Used


Impact

[8] Consider using '_alchemist' to save gas by not reading storage every time. Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L243
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L245
  3. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L247

Proof of Concept

Tools Used


Impact

[9] Consider reducing IF nesting by having revert first and the rest without else clause.

Affected code:

  1. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L307
  2. https://github.com/code-423n4/2022-05-alchemix/blob/71abbe683dfd5c0686b7e594fb4f78a14b668d8b/contracts-full/TransmuterBuffer.sol#L332-L338

Proof of Concept

Tools Used


AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter