Blur Exchange contest - ReyAdmirado's results

An NFT exchange for the Blur marketplace.

General Information

Platform: Code4rena

Start Date: 05/10/2022

Pot Size: $50,000 USDC

Total HM: 2

Participants: 80

Period: 5 days

Judge: GalloDaSballo

Id: 168

League: ETH

Blur Exchange

Findings Distribution

Researcher Performance

Rank: 77/80

Findings: 1

Award: $32.65

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

32.6464 USDC - $32.65

Labels

bug
G (Gas Optimization)

External Links

issue
1Unused local variable
2expressions for constant values such as a call to keccak256(), should use immutable rather than constant
3can just use the argument instead of making a stack variable
4stack variable is only used once, so we can simply use the function in the if statement instead of making a stack variable
5Add unchecked {} for subtractions where the operands cannot underflow because of a previous require() or if statement
6stack variable is only used once, just use the operation instead of making a stack variable
7<x> += <y> costs more gas than <x> = <x> + <y> for state variables
8not using the named return variables when a function returns, wastes deployment gas
9++i costs less gas than i++, especially when it’s used in for-loops (--i/i-- too)
10<array>.length should not be looked up in every loop of a for-loop
11can make the variable outside the loop to save gas
12it costs more gas to initialize non-constant/non-immutable variables to zero than to let the default of zero be applied
13++i/i++ should be unchecked{++i}/unchecked{i++} when it is not possible for them to overflow, as is the case when used in for-loop and while-loops
14require()/revert() strings longer than 32 bytes cost extra gas
15use custom errors rather than revert()/require() strings to save deployment gas
16use a more recent version of solidity
17using bool for storage incurs overhead
18internal functions only called once can be inlined to save gas
19abi.encode() is less efficient than abi.encodepacked()
20usage of uint/int smaller than 32 bytes (256 bits) incurs overhead
21using private rather than public for constants, saves gas
22avoid an unnecessary sstore by not writing a default value for bools
23bytes constants are more efficient than string constants
24public library function should be made private/internal
25public functions not called by the contract should be declared external instead
26use arguments instead of state var

1. Unused local variable

Some of the variables are fetched and allocated but not used

merklePath has not been used after being allocated

2. expressions for constant values such as a call to keccak256(), should use immutable rather than constant

3. can just use the argument instead of making a stack variable

use size instead of making length

4. stack variable is only used once, so we can simply use the function in the if statement instead of making a stack variable

5. Add unchecked {} for subtractions where the operands cannot underflow because of a previous require() or if statement

require(a <= b); x = b - a => require(a <= b); unchecked { x = b - a }

6. stack variable is only used once, just use the operation instead of making a stack variable

7. <x> += <y> costs more gas than <x> = <x> + <y> for state variables

8. not using the named return variables when a function returns, wastes deployment gas

9. ++i costs less gas than i++, especially when it’s used in for-loops (--i/i-- too)

Saves 6 gas per loop

10. <array>.length should not be looked up in every loop of a for-loop

This reduce gas cost as show here https://forum.openzeppelin.com/t/a-collection-of-gas-optimisation-tricks/19966/5

11. can make the variable outside the loop to save gas

12. it costs more gas to initialize non-constant/non-immutable variables to zero than to let the default of zero be applied

13. ++i/i++ should be unchecked{++i}/unchecked{i++} when it is not possible for them to overflow, as is the case when used in for-loop and while-loops

In Solidity 0.8+, there’s a default overflow check on unsigned integers. It’s possible to uncheck this in for-loops and save some gas at each iteration, but at the cost of some code readability, as this uncheck cannot be made inline.

14. require()/revert() strings longer than 32 bytes cost extra gas

15. use custom errors rather than revert()/require() strings to save deployment gas

https://blog.soliditylang.org/2021/04/21/custom-errors/

all require()s need to change

16. use a more recent version of solidity

solidity 8.16 is available now.

17. using bool for storage incurs overhead

https://github.com/OpenZeppelin/openzeppelin-contracts/blob/58f635312aa21f947cae5f8578638a85aa2519f5/contracts/security/ReentrancyGuard.sol#L23-L27

18. internal functions only called once can be inlined to save gas

Not inlining costs 20 to 40 gas because of two extra JUMP instructions and additional stack operations needed for function calls.

19. abi.encode() is less efficient than abi.encodepacked()

20. usage of uint/int smaller than 32 bytes (256 bits) incurs overhead

When using elements that are smaller than 32 bytes, your contract’s gas usage may be higher. This is because the EVM operates on 32 bytes at a time. Therefore, if the element is smaller than that, the EVM must use more operations in order to reduce the size of the element from 32 bytes to the desired size. https://docs.soliditylang.org/en/v0.8.11/internals/layout_in_storage.html Use a larger size then downcast where needed

21. using private rather than public for constants, saves gas

If needed, the values can be read from the verified contract source code, or if there are multiple values there can be a single getter function that returns a tuple of the values of all currently-public constants. Saves 3406-3606 gas in deployment gas due to the compiler not having to create non-payable getter functions for deployment calldata, not having to store the bytes of the value outside of where it’s used, and not adding another entry to the method ID table

22. avoid an unnecessary sstore by not writing a default value for bools

23. bytes constants are more efficient than string constants

If data can fit into 32 bytes, then you should use bytes32 datatype rather than bytes or strings as it is cheaper in solidity.

24. public library function should be made private/internal

Changing from public will remove the compiler-introduced checks for msg.value and decrease the contract’s method ID table size

25. public functions not called by the contract should be declared external instead

Contracts are allowed to override their parents’ functions and change the visibility from external to public and can save gas by doing so.

26. use arguments instead of state var

we can use the arguments in emits of setters instead of state var to save gas

#0 - GalloDaSballo

2022-10-22T23:31:58Z

5k from nonReentrant Rest is negligible

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter