Platform: Code4rena
Start Date: 21/11/2022
Pot Size: $90,500 USDC
Total HM: 18
Participants: 101
Period: 7 days
Judge: Picodes
Total Solo HM: 4
Id: 183
League: ETH
Rank: 85/101
Findings: 1
Award: $39.65
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: gzeon
Also found by: 0xPanda, 0xSmartContract, B2, Deivitto, Diana, JohnSmith, PaludoX0, Rahoz, RaymondFam, ReyAdmirado, Rolezn, Schlagatron, Secureverse, Tomio, __141345__, adriro, ajtra, aphak5010, c3phas, chaduke, codeislight, cryptonue, datapunk, dharma09, halden, karanctf, keccak123, oyc_109, pavankv, sakshamguruji, saneryee, unforgiven
39.6537 USDC - $39.65
General:
What is the purpose of continuously checking for address(0)? It uses up gas in almost every function but appears to serve little to no purpose. In permissioned functions like setProducer that can be overwritten at any time, this check serves no purpose. In setRewardToken: it checks for address(0) but doesn't check the index is within bounds (which is a more likely mistake) and either parameter being incorrect should cause no issues for funds or users. Then most importantly the non-permissioned functions only check address(0) but nothing else. What is the difference between a user passing in address(0) or address(1) etc. It seems to serve no purpose but added gas and complexity. In PirexGmx here and here you are checking if the token is address(0) then checking its a valid token directly after which is completely redundant.
-Loops can be optimized by changing ++i to doing unchecked { i ++ } at the end of the loop, here, here and here. -Instantiate variables outside of the loops to save gas here and here. -Allow a user to claim rewards without harvesting, harvesting is a gas intensive function and may want to be avoided if it was just recently called. Or at least to put a check on the last harvest so it is not harvested multiple times in the same block.
PxERC20/PirexRewards:
-Add a function in PirexRewards that can be called to both accrue Global and accrue an account in one call instead of having to make two separate calls to the same external contract in PxERC20 using one of the same variables.
Vaults: -Multiple deposits in the same block will cause redundant compounding calls
#0 - c4-judge
2022-12-05T14:31:41Z
Picodes marked the issue as grade-b
#1 - c4-sponsor
2022-12-09T05:34:54Z
drahrealm marked the issue as sponsor disputed
#2 - drahrealm
2022-12-09T05:35:15Z
It's more likely to mistakenly use address(0) than address(1), as address(0) is the default value on many cases when the parameter is not specified. The check is meant to save gas to revert the tx as soon as possible. Other than that, idem with issue #29 and #404