QuickSwap and StellaSwap contest - Ruhum's results

Report

• Low
  • L-01: use two-step process for criticial address changes
  • L-02: pool isn't initialized after creation

Low

L-01: use two-step process for criticial address changes

Consider using a two-step process for transferring the ownership of a contract. While it costs a little more gas, it's safer than transferring directly.

Here's an example from the Compound Timelock contract: https://github.com/compound-finance/compound-protocol/blob/master/contracts/Timelock.sol#L45-L58

• https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraFactory.sol#L77

L-02: pool isn't initialized after creation

A pool has a initialize() function where the initial price is set and the pool is unlocked. Inside the simulation and deployment scripts, the function is never called. Uniswap uses a custom contract, PoolInitializer, to deploy pools where the initialize function is called right after deployment.

• https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraPool.sol#L193
• https://github.com/code-423n4/2022-09-quickswap/blob/main/src/core/contracts/AlgebraFactory.sol#L69

Gas Report

• G-01: AlgebraPoolDeployer.owner can be immutable
• G-02: if clause in AlgebraPool.collect() can be split up to save gas

G-01: AlgebraPoolDeployer.owner can be immutable

The value is only set once in the constructor

G-02: if clause in AlgebraPool.collect() can be split up to save gas

if (amount0 | amount1 != 0) {
    position.fees0 = positionFees0 - amount0;
    position.fees1 = positionFees1 - amount1;

    if (amount0 > 0) TransferHelper.safeTransfer(token0, recipient, amount0);
    if (amount1 > 0) TransferHelper.safeTransfer(token1, recipient, amount1);
}

By splitting it up you save one if clause:

if (amount0 > 0) {
    position.fees0 = positionFees0 - amount0;
    TransferHelper.safeTransfer(token0, recipient, amount0);
}
if (amount1 > 0) {
    position.fees1 = positionFees1 - amount1;
    TransferHelper.safeTransfer(token1, recipient, amount1);
}