Juicebox Buyback Delegate - QiuhaoLi's results

Thousands of projects use Juicebox to fund, operate, and scale their ideas & communities transparently on Ethereum.

General Information

Platform: Code4rena

Start Date: 18/05/2023

Pot Size: $24,500 USDC

Total HM: 3

Participants: 72

Period: 4 days

Judge: LSDan

Id: 237

League: ETH

Juicebox

Findings Distribution

Researcher Performance

Rank: 22/72

Findings: 2

Award: $44.17

QA:
grade-b
Gas:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

[LOW] Should check parameters are not zero in the constructor

https://github.com/code-423n4/2023-05-juicebox/blob/main/juice-buyback/contracts/JBXBuybackDelegate.sol#L123

We should check projectToken, pool, and jbxTerminal are not zeros for sanity.

Even further, we can call relative read functions like totalSupply()>0 for _weth and supportsInterface for _jbxTerminal.

[non-critical] Ownable Module is not used

https://github.com/code-423n4/2023-05-juicebox/blob/main/juice-buyback/contracts/JBXBuybackDelegate.sol#L39

JBXBuybackDelegate inherits openzepplin's Ownable module, but there are no onlyOwner modifiers in the code. We should remove this module.

#0 - c4-judge

2023-06-02T11:02:28Z

dmvt marked the issue as grade-b

Findings Information

🌟 Selected for report: JCN

Also found by: 0x4non, Arz, Dimagu, K42, QiuhaoLi, Sathish9098, Tripathi, hunter_w3b, niser93, pfapostol

Labels

bug
G (Gas Optimization)
grade-b
G-03

Awards

27.9811 USDC - $27.98

External Links

_nonReservedTokenInContract is duplicated with _nonReservedToken

https://github.com/code-423n4/2023-05-juicebox/blob/main/juice-buyback/contracts/JBXBuybackDelegate.sol#L312

_nonReservedTokenInContract is calculated as:

            // 3) Burn the non-reserve token which are now left in this address (can be 0) -> result: 0 here, reservedToken in reserve
            uint256 _nonReservedTokenInContract = _amountReceived - _reservedToken;

Which is exactly _nonReservedToken:

        // The amount to add to the reserved token
        uint256 _reservedToken = _amountReceived - _nonReservedToken;

        // Send the non-reserved token to the beneficiary (if any / reserved rate is not max)
        if (_nonReservedToken != 0) projectToken.transfer(_data.beneficiary, _nonReservedToken);

Use _nonReservedToken can save like ~100 gas: didpay

Before:

| contracts/JBXBuybackDelegate.sol:JBXBuybackDelegate contract | | | | | | |--------------------------------------------------------------|-----------------|--------|--------|--------|---------| | Deployment Cost | Deployment Size | | | | | | 1310928 | 6825 | | | | | | Function Name | min | avg | median | max | # calls | | didPay | 54376 | 163964 | 148968 | 244808 | 7 |

Afer:

| contracts/JBXBuybackDelegate.sol:JBXBuybackDelegate contract | | | | | | |--------------------------------------------------------------|-----------------|--------|--------|--------|---------| | Deployment Cost | Deployment Size | | | | | | 1307928 | 6810 | | | | | | Function Name | min | avg | median | max | # calls | | didPay | 54308 | 163925 | 148900 | 244740 | 7 |

#0 - c4-judge

2023-06-02T10:53:22Z

dmvt marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter