JPYC contest - Omik's results

LOW : 1. Title : approve() and increaseAllowance() had different checkWhitelist condition

Impact : checkWhitelist modifier in the approve() and increaseAllowance() is used to preventing giving more allowance more than 100.000 token, when userA already given allowance for 100.000 token to userB, userA can't give another allowance through increaseAllowance(), however userA still can give userB allowance for another 100.000 token by calling approve(), by repeating this userB can get an allowance more than it allowed, assuming userA and userB is not whitelisted.

POC : https://github.com/code-423n4/2022-02-jpyc/blob/main/contracts/v2/FiatTokenV2.sol#L235

Title : change decimals to hardcoded value

Impact : to minimize user error on calling initialize(), the decimals value should be set to constant and hardcoded in the storage.

POC : https://github.com/code-423n4/2022-02-jpyc/blob/main/contracts/v2/FiatTokenV2.sol#L105

GAS : 1. Title : use constant value.

Impact : In the checkWhitelist modifier instead of doing calculation every time this modifier is executed, its cheaper to make it a constant variable in the storage, and the checkWhitelist only need to call the constant variable.

POC : https://github.com/code-423n4/2022-02-jpyc/blob/main/contracts/v2/FiatTokenV2.sol#L624

Title : use unchecked is way cheaper

Impact : In the solidity version 0.8 above there already default check on underflow and overflow, and since https://github.com/code-423n4/2022-02-jpyc/blob/main/contracts/v2/FiatTokenV2.sol#L326 there is already check on amount and balance[from], and check by default on solidity 0.8 above, its cheaper to use unchecked blok for the balance calculation the subtraction and add.

POC : https://github.com/code-423n4/2022-02-jpyc/blob/main/contracts/v2/FiatTokenV2.sol#L326-L327

Title : its cheaper to use constant variable

Impact : its cheaper to call decimals, name, and symbol as a constant value, since these variable shouldn't change after deployement. You can do this by hardcoded this value directly in the storage.

POC : https://github.com/code-423n4/2022-02-jpyc/blob/main/contracts/v2/FiatTokenV2.sol#L51