Platform: Code4rena
Start Date: 02/06/2023
Pot Size: $100,000 USDC
Total HM: 15
Participants: 75
Period: 7 days
Judge: Picodes
Total Solo HM: 5
Id: 249
League: ETH
Rank: 39/75
Findings: 2
Award: $40.19
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: RaymondFam
Also found by: 0xWaitress, 0xhacksmithh, ChrisTina, DadeKuma, LaScaloneta, Rolezn, SAAJ, Sathish9098, T1MOH, bin2chen, btk, catellatech, ernestognw, fatherOfBlocks, hals, hunter_w3b, jaraxxus, matrix_0wl, mgf15, naman1778, niser93, solsaver, turvy_fuzz
18.5651 USDC - $18.57
Address(0) check is missing in mint function, consider applying check to ensure tokens aren’t minted to the zero address.
Link to the code: https://github.com/code-423n4/2023-06-stader/blob/main/contracts/ETHx.sol#L48
Important parameter or configuration changes should trigger an event to allow being tracked off-chain.
Link to the code:
Consider using a modifier to implement access control instead of inlining the condition/requirement in the function’s body.
Link to the code:
OpenZeppelin recommends that the initializer modifier be applied to constructors in order to avoid potential griefs, social engineering, or exploits. Ensure that the modifier is applied to the implementation contract. If the default constructor is currently being used, it should be changed to be an explicit one with the modifier applied.
Link to the code:
It is a good practice to give time for users to react and adjust to critical changes. A timelock provides more guarantees and reduces the level of trust required, thus decreasing risk for users. It also indicates that the project is legitimate (less risk of a malicious owner making a sandwich attack on a user).
Link to the code:
Link to the code:
Zero-address check should be used, to avoid the risk of setting a storage variable as address(0) at deploying time.
Link to the code:
Link to the code:
Locking pragma version ensures contracts are not being deployed on an outdated compiler version.
Link to the code: https://github.com/code-423n4/2023-06-stader/blob/main/contracts/VaultProxy.sol#L2
Avoid using code blocks or use them for some process like emitting events.
Link to the code: https://github.com/code-423n4/2023-06-stader/blob/main/contracts/NodeELRewardVault.sol#L14
All Contracts Order of functions should help readers identify which functions they can call and to find the constructor and fallback definitions easier.
Functions should be grouped according to their visibility and ordered as mentioned in the article i.e.; constructor external public internal private within a grouping, place the view and pure functions last
#0 - c4-judge
2023-06-14T06:09:16Z
Picodes marked the issue as grade-b
🌟 Selected for report: JCN
Also found by: 0x70C9, 0xSmartContract, 0xWaitress, 0xhacksmithh, DavidGiladi, K42, LaScaloneta, Rageur, Raihan, SAAJ, SAQ, SM3_SS, Sathish9098, Tomio, bigtone, c3phas, ernestognw, etherhood, koxuan, matrix_0wl, mgf15, naman1778, niser93, petrichor, piyushshukla, sebghatullah, shamsulhaq123
21.6219 USDC - $21.62
This report focuses on Stader Protocol contest, in context of various improvements that can be made in terms of gas cost.
Some of the opportunities identified for improving gas efficiency throughout the codebase of stader protocol are categorised into 10 main areas; with further multiple instances in each of the category.
Using immutable instead of constant, save more gas due to avoiding storage access for state variables.
Variable values are set through constructor when using immutable, which also eliminates the need of assigning initial values to state variable making them more efficient in terms of gas cost.
Link to the Code:
Instead of using address(this), it is more gas-efficient to pre-calculate and use the hardcoded address.
Link to the code:
Link to the Code:
Boolean for storage if not used, saves Gwarmaccess 100 gas. In addition, state changes of boolean from true to false can cost up to ~20000 gas rather than uint256(2) to uint256(1) that would cost significantly less.
Link to the Code:
Saves ~13 gas per instance
Link to the Code:
Functions with public visibility, if not called within the contract needed to be changed external.
Link to the Code:
Refer to this article.
Link to the Code:
String literals can be split into multiple parts and still be considered as a single string literal. EACH new comma costs 21 gas due to stack operations and separate MSTOREs.
Link to the Code:
Link to the Code:
Using calldata in external function does not require data to be stored, which reduced the process time as compared to memory. This in return saves gas during calling the data.
Link to the Code:
#0 - c4-judge
2023-06-14T05:44:09Z
Picodes marked the issue as grade-b