Mimo August 2022 contest - ReyAdmirado's results

Bridging the chasm between the DeFi world and the world of regulated financial institutions.

General Information

Platform: Code4rena

Start Date: 02/08/2022

Pot Size: $50,000 USDC

Total HM: 12

Participants: 69

Period: 5 days

Judge: gzeon

Total Solo HM: 5

Id: 150

League: ETH

Mimo DeFi

Findings Distribution

Researcher Performance

Rank: 34/69

Findings: 2

Award: $112.75

🌟 Selected for report: 0

🚀 Solo Findings: 0

1. typo in comments

struc --> struct

paking --> packing

aggegator --> aggregator

allowedVaration --> allowedVariation

rebalnce --> rebalance

2. constants should be defined rather than using magic numbers

Even assembly can benefit from using readable constants instead of hex/numeric literals

3. lines are too long

Usually lines in source code are limited to 80 characters. Today’s screens are much larger so it’s reasonable to stretch this in some cases. Since the files will most likely reside in GitHub, and GitHub starts using a scroll bar in all cases when the length is over 164 characters, the lines below should be split when they reach that length

4. should fix the version

Contracts should be deployed with the same compiler version and flags that they have been tested with thoroughly. Locking the pragma helps to ensure that contracts do not accidentally get deployed using, for example, an outdated compiler version that might introduce bugs that affect the contract system negatively.

1. using calldata instead of memory for read-only arguments in external functions saves gas

2. abi.encode() is less efficient than abi.encodepacked()

3. not using the named return variables when a function returns, wastes deployment gas

4. using bools for storage incurs overhead

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/58f635312aa21f947cae5f8578638a85aa2519f5/contracts/security/ReentrancyGuard.sol#L23-L27

Use uint256(1) and uint256(2) for true/false to avoid a Gwarmaccess (100 gas) for the extra SLOAD, and to avoid Gsset (20000 gas) when changing from ‘false’ to ‘true’, after having been ‘true’ in the past

5. state variables only set in the constructor should be declared immutable

avoids a gsset (20000 gas)

6. state variables should be cached in stack variables rather than re-reading them from storage

owner

7. can make the variable outside the loop to save gas

8. <array>.length should not be looked up in every loop of a for-loop

9. ++i costs less gas than i++, especially when it’s used in for-loops (--i/i-- too)

Saves 6 gas per loop

10. it costs more gas to initialize non-constant/non-immutable variables to zero than to let the default of zero be applied

11. ++i/i++ should be unchecked{++i}/unchecked{i++} when it is not possible for them to overflow, as is the case when used in for-loop and while-loops

12. Use a solidity version of at least 0.8.10 to have external calls skip contract existence checks if the external call has a return value

only in files

13. Use a solidity version of at least 0.8.13 to get the ability to use using for with a list of free functions

14. using private rather than public for constants, saves gas

If needed, the values can be read from the verified contract source code, or if there are multiple values there can be a single getter function that returns a tuple of the values of all currently-public constants. Saves 3406-3606 gas in deployment gas due to the compiler not having to create non-payable getter functions for deployment calldata, not having to store the bytes of the value outside of where it’s used, and not adding another entry to the method ID table

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter