Nouns Builder contest - ReyAdmirado's results

A permissionless, governed protocol to deploy nouns-style DAOs complete with treasury, generative collections, and governance mechanisms.

General Information

Platform: Code4rena

Start Date: 06/09/2022

Pot Size: $90,000 USDC

Total HM: 33

Participants: 168

Period: 9 days

Judge: GalloDaSballo

Total Solo HM: 10

Id: 157

League: ETH

Nouns Builder

Findings Distribution

Researcher Performance

Rank: 77/168

Findings: 2

Award: $110.46

🌟 Selected for report: 0

🚀 Solo Findings: 0

1. inconsistent use of named return variables

there is an inconsistent use of named return variables in the contract some functions return named variables, others return explicit values. consider adopting a consistent approach. this would improve both the explicitness and readability of the code, and it may also help reduce regressions during future code refactors. these returns are different from other parts of the code:

2. typo in comments

recieve --> receive

psuedo --> pseudo

responsiblity --> responsibility

addresss --> address

seperator --> separator

3. event is missing indexed fields

Each event should use three indexed fields if there are three or more fields

4. _safemint() should be used rather than _mint() wherever possible

5. constants should be defined rather than using magic numbers

Even assembly can benefit from using readable constants instead of hex/numeric literals

every 100 in _addFounders:

and:

6. remove inconsistencies with the main code

change these interfaces to the same version used in the main code

#0 - GalloDaSballo

2022-09-27T00:45:36Z

1. inconsistent use of named return variables

NC

2. typo in comments

NC

5. constants should be defined rather than using magic numbers

R

1R 2NC

1. <x> += <y> costs more gas than <x> = <x> + <y> for state variables

2. can make the variable outside the loop to save gas

3. ++x costs less gas than x++

4. it costs more gas to initialize non-constant/non-immutable variables to zero than to let the default of zero be applied

5. using calldata instead of memory for read-only arguments in external functions saves gas

6. using bools for storage incurs overhead

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/58f635312aa21f947cae5f8578638a85aa2519f5/contracts/security/ReentrancyGuard.sol#L23-L27 Use uint256(1) and uint256(2) for true/false to avoid a Gwarmaccess (100 gas) for the extra SLOAD, and to avoid Gsset (20000 gas) when changing from ‘false’ to ‘true’, after having been ‘true’ in the past

7. internal functions only called once can be inlined to save gas

Not inlining costs 20 to 40 gas because of two extra JUMP instructions and additional stack operations needed for function calls.

8. private functions only called once can be inlined to save gas

Not inlining costs 20 to 40 gas because of two extra JUMP instructions and additional stack operations needed for function calls.

9. abi.encode() is less efficient than abi.encodepacked()

10. usage of uint/int smaller than 32 bytes (256 bits) incurs overhead

When using elements that are smaller than 32 bytes, your contract’s gas usage may be higher. This is because the EVM operates on 32 bytes at a time. Therefore, if the element is smaller than that, the EVM must use more operations in order to reduce the size of the element from 32 bytes to the desired size. https://docs.soliditylang.org/en/v0.8.11/internals/layout_in_storage.html Use a larger size then downcast where needed

11. using private rather than public for constants, saves gas

If needed, the values can be read from the verified contract source code, or if there are multiple values there can be a single getter function that returns a tuple of the values of all currently-public constants. Saves 3406-3606 gas in deployment gas due to the compiler not having to create non-payable getter functions for deployment calldata, not having to store the bytes of the value outside of where it’s used, and not adding another entry to the method ID table

12. expressions for constant values such as a call to keccak256(), should use immutable rather than constant

13. bytes constants are more efficient than string constants

If data can fit into 32 bytes, then you should use bytes32 datatype rather than bytes or strings as it is cheaper in solidity.

#0 - GalloDaSballo

2022-09-26T20:21:20Z

Loop Storage Read

300

Memory -> Calldata

500

800

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter