Fraxlend (Frax Finance) contest - ReyAdmirado's results

Fraxlend: A permissionless lending platform and the final piece of the Frax Finance Defi Trinity.

General Information

Platform: Code4rena

Start Date: 12/08/2022

Pot Size: $50,000 USDC

Total HM: 15

Participants: 120

Period: 5 days

Judge: Justin Goro

Total Solo HM: 6

Id: 153

League: ETH

Frax Finance

Findings Distribution

Researcher Performance

Rank: 39/120

Findings: 2

Award: $69.32

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository Frax Finance

Findings Information

🌟 Selected for report: 0x1f8b

Also found by: 0x52, 0xA5DF, 0xDjango, 0xNazgul, 0xNineDec, 0xSmartContract, 0xmatt, 0xsolstars, Aymen0909, Bnke0x0, CertoraInc, Chom, CodingNameKiki, Deivitto, Dravee, ElKu, EthLedger, Funen, IllIllI, JC, Junnon, Lambda, LeoS, MiloTruck, Noah3o6, PaludoX0, ReyAdmirado, Rohan16, RoiEvenHaim, Rolezn, SaharAP, Sm4rty, SooYa, The_GUILD, TomJ, Waze, Yiko, _Adam, __141345__, a12jmx, ak1, asutorufos, auditor0517, ayeslick, ballx, beelzebufo, berndartmueller, bin2chen, brgltd, c3phas, cRat1st0s, cccz, cryptonue, cryptphi, d3e4, delfin454000, dipp, djxploit, durianSausage, dy, erictee, fatherOfBlocks, gogo, gzeon, hyh, ignacio, kyteg, ladboy233, medikko, mics, minhquanym, oyc_109, pfapostol, rbserver, reassor, ret2basic, robee, sach1r0, simon135, sryysryy, tabish, yac, yash90, zzzitron

Awards

46.6022 USDC - $46.60

Labels

bug

QA (Quality Assurance)

External Links

Link to GitHub issue

1. use of floating pragma

Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.

2. typo in comments

toBorrtoBorrowAmountowShares --> toBorrowAmount

FraxlendPair.sol#L190

whos -- whom

approcal --> approval

accomodate --> accommodate

FraxlendPairDeployer.sol#L168

FraxLedWhitelist --> FraxLendWhitelist

FraxlendPairDeployer.sol#L346

whitlist --> whitelist

FraxlendPairCore.sol#L231

occured --> occurred

FraxlendPairCore.sol#L893

liabilites --> liabilities

FraxlendPairCore.sol#L896

Calced --> Calculated

FraxlendPairCore.sol#L992

stuct --> struct

FraxlendPairCore.sol#L1010

oralce --> oracle

FraxlendWhitelist.sol#L47

3. event is missing indexed fields

Each event should use three indexed fields if there are three or more fields

4. _safemint() should be used rather than _mint() wherever possible

5. constants should be defined rather than using magic numbers

Even assembly can benefit from using readable constants instead of hex/numeric literals

6. lines are too long

Usually lines in source code are limited to 80 characters. Today’s screens are much larger so it’s reasonable to stretch this in some cases. Since the files will most likely reside in GitHub, and GitHub starts using a scroll bar in all cases when the length is over 164 characters, the lines below should be split when they reach that length

Findings Information

🌟 Selected for report: IllIllI

Also found by: 0x1f8b, 0xA5DF, 0xDjango, 0xNazgul, 0xSmartContract, 0xackermann, 0xbepresent, 0xc0ffEE, 0xkatana, 2997ms, Amithuddar, Aymen0909, Bnke0x0, Chinmay, Chom, CodingNameKiki, Deivitto, Diraco, Dravee, ElKu, EthLedger, Fitraldys, Funen, IgnacioB, JC, Junnon, Lambda, LeoS, Metatron, MiloTruck, Noah3o6, NoamYakov, PaludoX0, Randyyy, ReyAdmirado, Rohan16, Rolezn, Ruhum, SaharAP, Sm4rty, SooYa, TomJ, Tomio, Waze, Yiko, _Adam, __141345__, a12jmx, ajtra, ak1, asutorufos, ballx, brgltd, c3phas, cRat1st0s, carlitox477, chrisdior4, d3e4, delfin454000, dharma09, djxploit, durianSausage, erictee, fatherOfBlocks, find_a_bug, flyx, francoHacker, gerdusx, gogo, gzeon, hakerbaya, ignacio, jag, kyteg, ladboy233, ltyu, m_Rassska, medikko, mics, mrpathfindr, newfork01, nxrblsrpr, oyc_109, pfapostol, rbserver, reassor, ret2basic, robee, sach1r0, saian, simon135, sryysryy, zeesaw

Awards

22.7202 USDC - $22.72

Labels

bug

G (Gas Optimization)

External Links

Link to GitHub issue

1. state variables only set in the constructor should be declared immutable

avoids a gsset (20000 gas)

2. `<x> += <y>` costs more gas than `<x> = <x> + <y>` for state variables

3. not using the named return variables when a function returns, wastes deployment gas

4. `<array>.length` should not be looked up in every loop of a for-loop

This reduce gas cost as show here https://forum.openzeppelin.com/t/a-collection-of-gas-optimisation-tricks/19966/5 1- if it is a storage array, this is an extra sload operation (100 additional extra gas (EIP-2929 2) for each iteration except for the first), 2- if it is a memory array, this is an extra mload operation (3 additional gas for each iteration except for the first), 3- if it is a calldata array, this is an extra calldataload operation (3 additional gas for each iteration except for the first)

5. `++i` costs less gas than `i++`, especially when it’s used in for-loops (--i/i-- too)

Saves 6 gas per loop

6. it costs more gas to initialize non-constant/non-immutable variables to zero than to let the default of zero be applied

7. `++i/i++` should be `unchecked{++i}/unchecked{i++}` when it is not possible for them to overflow, as is the case when used in for-loop and while-loops

8. require()/revert() strings longer than 32 bytes cost extra gas

9. use custom errors rather than revert()/require() strings to save deployment gas

https://blog.soliditylang.org/2021/04/21/custom-errors/

10. using `calldata` instead of `memory` for read-only arguments in external functions saves gas

11. using `bools` for storage incurs overhead

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/58f635312aa21f947cae5f8578638a85aa2519f5/contracts/security/ReentrancyGuard.sol#L23-L27 Use uint256(1) and uint256(2) for true/false to avoid a Gwarmaccess (100 gas) for the extra SLOAD, and to avoid Gsset (20000 gas) when changing from ‘false’ to ‘true’, after having been ‘true’ in the past

12. abi.encode() is less efficient than abi.encodepacked()

13. usage of uint/int smaller than 32 bytes (256 bits) incurs overhead

When using elements that are smaller than 32 bytes, your contract’s gas usage may be higher. This is because the EVM operates on 32 bytes at a time. Therefore, if the element is smaller than that, the EVM must use more operations in order to reduce the size of the element from 32 bytes to the desired size. https://docs.soliditylang.org/en/v0.8.11/internals/layout_in_storage.html Use a larger size then downcast where needed

14. using > 0 costs more gas than != 0 when used on a uint in a require() statement

FraxlendWhitelist.sol#L81

Fraxlend (Frax Finance) contest - ReyAdmirado's results

Fraxlend: A permissionless lending platform and the final piece of the Frax Finance Defi Trinity.

General Information

Findings Distribution

Researcher Performance

External Links

[Q-67] QA Report - $46.60

Findings Information

Awards

Labels

External Links

1. use of floating pragma

2. typo in comments

3. event is missing indexed fields

4. _safemint() should be used rather than _mint() wherever possible

5. constants should be defined rather than using magic numbers

6. lines are too long

[G-78] Gas Report - $22.72

Findings Information

Awards

Labels

External Links

1. state variables only set in the constructor should be declared immutable

2. <x> += <y> costs more gas than <x> = <x> + <y> for state variables

3. not using the named return variables when a function returns, wastes deployment gas

4. <array>.length should not be looked up in every loop of a for-loop

5. ++i costs less gas than i++, especially when it’s used in for-loops (--i/i-- too)

6. it costs more gas to initialize non-constant/non-immutable variables to zero than to let the default of zero be applied

7. ++i/i++ should be unchecked{++i}/unchecked{i++} when it is not possible for them to overflow, as is the case when used in for-loop and while-loops

8. require()/revert() strings longer than 32 bytes cost extra gas

9. use custom errors rather than revert()/require() strings to save deployment gas

10. using calldata instead of memory for read-only arguments in external functions saves gas

11. using bools for storage incurs overhead

12. abi.encode() is less efficient than abi.encodepacked()

13. usage of uint/int smaller than 32 bytes (256 bits) incurs overhead

14. using > 0 costs more gas than != 0 when used on a uint in a require() statement

15. splitting require() statements that use && saves gas

2. `<x> += <y>` costs more gas than `<x> = <x> + <y>` for state variables

4. `<array>.length` should not be looked up in every loop of a for-loop

5. `++i` costs less gas than `i++`, especially when it’s used in for-loops (--i/i-- too)

7. `++i/i++` should be `unchecked{++i}/unchecked{i++}` when it is not possible for them to overflow, as is the case when used in for-loop and while-loops

10. using `calldata` instead of `memory` for read-only arguments in external functions saves gas

11. using `bools` for storage incurs overhead