Badger Citadel contest - Ruhum's results

Report

• owner can change token price while sale is live
• owner can change token limit while sale is live

owner can change token price while sale is live

Even after the sale has started the owner is still able to adjust the price of the token.

Just like the other config parameters, e.g. saleStart it would be more transparent for the user if the price is either static or is bound to a predefined formula.

From the documentation, I don't see a reason for ever changing the price while the sale is live. So you might as well not allow it at all.

function setTokenOutPrice(uint256 _tokenOutPrice) external onlyOwner {
    require(block.timestamp <= saleStart);
    require(_tokenOutPrice > 0, "TokenSale: the price must not be zero");
    tokenOutPrice = _tokenOutPrice;

    emit TokenOutPriceUpdated(_tokenOutPrice);
}

owner can change token limit while sale is live

Even after the sale has started the owner is still able to adjust the number of tokens that can be sold. Pretty much the same thing as the above issue. Again I don't see a reason for increasing or decreasing the limit while the sale is live.

function setTokenInLimit(uint256 _tokenInLimit) external onlyOwner {
    require(block.timestamp <= saleStart);
    require(!finalized, "TokenSale: already finalized");
    tokenInLimit = _tokenInLimit;

    emit TokenInLimitUpdated(_tokenInLimit);
}

Report

Improved caching of state variables for the buy() function to reduce the user's gas costs

• saleStart
• increased totalTokenIn
• guestlist
• Optimizer

saleStart

The saleStart state variable is read twice. Caching it reduces gas costs by 185.

function buy(
    uint256 _tokenInAmount,
    uint8 _daoId,
    bytes32[] calldata _proof
) external whenNotPaused returns (uint256 tokenOutAmount_) {
  uint _saleStart = saleStart;
  require(_saleStart <= block.timestamp, "TokenSale: not started");
  require(
      block.timestamp < _saleStart + saleDuration,
      "TokenSale: already ended"
  );
  // rest of the function
}

increased totalTokenIn

The totalTokenIn + _tokenInAmount operation is executed twice. Caching it will reduce gas costs by 294.

function buy(
    uint256 _tokenInAmount,
    uint8 _daoId,
    bytes32[] calldata _proof
) external whenNotPaused returns (uint256 tokenOutAmount_) {
  // ...
  require(_tokenInAmount > 0, "_tokenInAmount should be > 0");
  uint newTotalTokenIn = totalTokenIn + _tokenInAmount;
  require(
      newTotalTokenIn <= tokenInLimit,
      "total amount exceeded"
  );
  // ...

  totalTokenIn = newTotalTokenIn;

  //...
}

guestlist

caching guestlist will save 123 gas.

function buy(
    uint256 _tokenInAmount,
    uint8 _daoId,
    bytes32[] calldata _proof
) external whenNotPaused returns (uint256 tokenOutAmount_) {
  // ...


  BadgerGuestListAPI _guestlist = guestlist;
  if (address(_guestlist) != address(0)) {
      require(_guestlist.authorized(msg.sender, _proof), "not authorized");
  }

  // ...
}

Optimizer

After compiling with the optimizer (200 runs) the gas savings are around 465 gas in total.