Platform: Code4rena
Start Date: 22/08/2022
Pot Size: $50,000 USDC
Total HM: 4
Participants: 160
Period: 5 days
Judge: gzeon
Total Solo HM: 2
Id: 155
League: ETH
Rank: 151/160
Findings: 1
Award: $16.66
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: IllIllI
Also found by: 0x040, 0x1f8b, 0xDjango, 0xNazgul, 0xNineDec, 0xSmartContract, 0xbepresent, 0xc0ffEE, 0xkatana, 2997ms, ACai, Amithuddar, Aymen0909, Ben, BipinSah, Bjorn_bug, Bnke0x0, CertoraInc, Ch_301, Chom, CodingNameKiki, Deivitto, DevABDee, DimitarDimitrov, Diraco, Dravee, ElKu, EthLedger, Fitraldys, Funen, GalloDaSballo, GimelSec, Guardian, IgnacioB, JC, JohnSmith, Junnon, KIntern_NA, Lambda, LeoS, Noah3o6, Olivierdem, Polandia94, R2, Randyyy, RaymondFam, Respx, ReyAdmirado, Rohan16, RoiEvenHaim, Rolezn, Ruhum, SaharAP, Saintcode_, SerMyVillage, Shishigami, Sm4rty, SooYa, TomJ, Tomio, Tomo, Waze, Yiko, _Adam, __141345__, a12jmx, ajtra, ak1, bobirichman, brgltd, bulej93, c3phas, cRat1st0s, carlitox477, catchup, ch0bu, d3e4, delfin454000, djxploit, durianSausage, erictee, exolorkistis, fatherOfBlocks, francoHacker, gogo, hyh, ignacio, jag, joestakey, karanctf, ladboy233, lucacez, lukris02, m_Rassska, martin, medikko, mics, mrpathfindr, natzuu, newfork01, oyc_109, pauliax, peritoflores, pfapostol, prasantgupta52, rbserver, ret2basic, rfa, robee, rokinot, rotcivegaf, rvierdiiev, sach1r0, saian, samruna, seyni, shark, shr1ftyy, sikorico, simon135, sryysryy, tay054, tnevler, wagmi, zishansami
16.6568 USDC - $16.66
the function _beforeTokenTransfer from contracts/base/ERC721Enumerable.sol is called in three places, if we move the logic from _beforeTokenTransfer to _mint, _transfer, _burn four checks on every transfer will be eliminated.
we need to remove lines 81-113 from contracts/base/ERC721Enumerable.sol and replace with
function _transfer( address from, address to, uint256 tokenId ) internal virtual override{ if (to != from) { _removeTokenFromOwnerEnumeration(from, tokenId); // because to and from are != 0 and to !=from _addTokenToOwnerEnumeration(to, tokenId); // because to and from are != 0 and to !=from } super._transfer(from, to, tokenId); } function _mint( address creator, address to, uint256 tokenId ) internal virtual override{ _addTokenToAllTokensEnumeration(tokenId); // because from == 0 _addTokenToOwnerEnumeration(to, tokenId); // because to to !=from, to can't be 0 super._mint(creator, to, tokenId); } function _burn(uint256 tokenId) internal virtual override{ _removeTokenFromOwnerEnumeration(ownerOf(tokenId), tokenId); / because to to !=from, from can't be 0 _removeTokenFromAllTokensEnumeration(tokenId); // because to == 0 super._burn(tokenId); }
because in mint, burn and transfer we know if the from and to are the 0 address, so its not necessary to check at runtime(because it's not allowed transfer to the 0 address or mint to the 0 address in the ERC721.sol contract)