Rigor Protocol contest - ReyAdmirado's results

Community lending and instant payments for new home construction.

General Information

Platform: Code4rena

Start Date: 01/08/2022

Pot Size: $50,000 USDC

Total HM: 26

Participants: 133

Period: 5 days

Judge: Jack the Pug

Total Solo HM: 6

Id: 151

League: ETH

Rigor Protocol

Findings Distribution

Researcher Performance

Rank: 65/133

Findings: 2

Award: $62.66

🌟 Selected for report: 0

🚀 Solo Findings: 0

1. _safemint() should be used rather than _mint() wherever possible

2. unnecessary confusing syntax

3. inconsistent spacing in comments

Some lines use // x and some use //x. The instances below point out the usages that don’t follow the majority, within each file

4. library/interface files should use ^ before versions

5. constants should be defined rather than using magic numbers

Even assembly can benefit from using readable constants instead of hex/numeric literals

#0 - zgorizzo69

2022-08-08T17:51:25Z

thanks for your work

1. state variables can be packed into fewer storage slots

If variables occupying the same slot are both written the same function or by the constructor, avoids a separate Gsset (20000 gas). Reads of the variables are also cheaper.

bring L78 after L68:

2. <x> += <y> costs more gas than <x> = <x> + <y> for state variables

3. not using the named return variables when a function returns, wastes deployment gas

4. can make the variable outside the loop to save gas

5. <array>.length should not be looked up in every loop of a for-loop

6. ++i costs less gas than i++, especially when it’s used in for-loops (--i/i-- too)

7. it costs more gas to initialize non-constant/non-immutable variables to zero than to let the default of zero be applied

8. ++i/i++ should be unchecked{++i}/unchecked{i++} when it is not possible for them to overflow, as is the case when used in for-loop and while-loops

9. splitting require() statements that use && saves gas

10. use custom errors rather than revert()/require() strings to save deployment gas

https://blog.soliditylang.org/2021/04/21/custom-errors/

11. Use a solidity version of at least 0.8.10 to have external calls skip contract existence checks if the external call has a return value

12. using calldata instead of memory for read-only arguments in external functions saves gas

13. using bools for storage incurs overhead

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/58f635312aa21f947cae5f8578638a85aa2519f5/contracts/security/ReentrancyGuard.sol#L23-L27

Use uint256(1) and uint256(2) for true/false to avoid a Gwarmaccess (100 gas) for the extra SLOAD, and to avoid Gsset (20000 gas) when changing from ‘false’ to ‘true’, after having been ‘true’ in the past

14. usage of uints/ints smaller than 32 bytes (256 bits) incurs overhead

When using elements that are smaller than 32 bytes, your contract’s gas usage may be higher. This is because the EVM operates on 32 bytes at a time. Therefore, if the element is smaller than that, the EVM must use more operations in order to reduce the size of the element from 32 bytes to the desired size.

https://docs.soliditylang.org/en/v0.8.11/internals/layout_in_storage.html Use a larger size then downcast where needed

15. using private rather than public for constants, saves gas

If needed, the values can be read from the verified contract source code, or if there are multiple values there can be a single getter function that returns a tuple of the values of all currently-public constants. Saves 3406-3606 gas in deployment gas due to the compiler not having to create non-payable getter functions for deployment calldata, not having to store the bytes of the value outside of where it’s used, and not adding another entry to the method ID table

#0 - zgorizzo69

2022-08-08T17:49:04Z

thanks for your work

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter