Redacted Cartel contest - Schlagatron's results

Boosted GMX assets from your favorite liquid token wrapper, Pirex - brought to you by Redacted Cartel.

General Information

Platform: Code4rena

Start Date: 21/11/2022

Pot Size: $90,500 USDC

Total HM: 18

Participants: 101

Period: 7 days

Judge: Picodes

Total Solo HM: 4

Id: 183

League: ETH

Redacted Cartel

Findings Distribution

Researcher Performance

Rank: 85/101

Findings: 1

Award: $39.65

Gas:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

39.6537 USDC - $39.65

Labels

bug
G (Gas Optimization)
grade-b
sponsor disputed
G-04

External Links

General:

What is the purpose of continuously checking for address(0)? It uses up gas in almost every function but appears to serve little to no purpose. In permissioned functions like setProducer that can be overwritten at any time, this check serves no purpose. In setRewardToken: it checks for address(0) but doesn't check the index is within bounds (which is a more likely mistake) and either parameter being incorrect should cause no issues for funds or users. Then most importantly the non-permissioned functions only check address(0) but nothing else. What is the difference between a user passing in address(0) or address(1) etc. It seems to serve no purpose but added gas and complexity. In PirexGmx here and here you are checking if the token is address(0) then checking its a valid token directly after which is completely redundant.

PirexRewards:

-Loops can be optimized by changing ++i to doing unchecked { i ++ } at the end of the loop, here, here and here. -Instantiate variables outside of the loops to save gas here and here. -Allow a user to claim rewards without harvesting, harvesting is a gas intensive function and may want to be avoided if it was just recently called. Or at least to put a check on the last harvest so it is not harvested multiple times in the same block.

PxERC20/PirexRewards:

-Add a function in PirexRewards that can be called to both accrue Global and accrue an account in one call instead of having to make two separate calls to the same external contract in PxERC20 using one of the same variables.

Vaults: -Multiple deposits in the same block will cause redundant compounding calls

#0 - c4-judge

2022-12-05T14:31:41Z

Picodes marked the issue as grade-b

#1 - c4-sponsor

2022-12-09T05:34:54Z

drahrealm marked the issue as sponsor disputed

#2 - drahrealm

2022-12-09T05:35:15Z

It's more likely to mistakenly use address(0) than address(1), as address(0) is the default value on many cases when the parameter is not specified. The check is meant to save gas to revert the tx as soon as possible. Other than that, idem with issue #29 and #404

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter