veToken Finance contest - TomJ's results

Lock more veAsset permanently.

General Information

Platform: Code4rena

Start Date: 26/05/2022

Pot Size: $75,000 USDT

Total HM: 31

Participants: 71

Period: 7 days

Judge: GalloDaSballo

Total Solo HM: 18

Id: 126

League: ETH

veToken Finance

Findings Distribution

Researcher Performance

Rank: 63/71

Findings: 1

Award: $52.45

🌟 Selected for report: 0

🚀 Solo Findings: 0

[G-01] Unnecessary variable initialization of default value

When variable is not initialized, then it will have default values. Example: 0 for uint, false for bool and address(0) for address

I suggest removing default value initialization for following variables.

BaseRewardPool.sol 66: uint256 public periodFinish = 0; 67: uint256 public rewardRate = 0; 70: uint256 public queuedRewards = 0; 71: uint256 public currentRewards = 0; 72: uint256 public historicalRewards = 0; 176: for (uint256 i = 0; i < extraRewards.length; i++) { 199: for (uint256 i = 0; i < extraRewards.length; i++) { 218: for (uint256 i = 0; i < extraRewards.length; i++) { 245: for (uint256 i = 0; i < extraRewards.length; i++) { 282: for (uint256 i = 0; i < extraRewards.length; i++) { Booster.sol 329: for (uint256 i = 0; i < poolInfo.length; i++) { VE3DRewardPool.sol 148: for (uint256 i = 0; i < rewardTokens.length(); i++) { 214: for (uint256 i = 0; i < length; i++) { 238: for (uint256 i = 0; i < length; i++) { 257: for (uint256 i = 0; i < length; i++) { 281: for (uint256 i = 0; i < rewardTokens.length(); i++) { 326: for (uint256 i = 0; i < length; i++) { VeAssetDepositor.sol 28: uint256 public incentiveVeAsset = 0;

For example these can change to:

  • uint256 public periodFinish;
  • for (uint256 i; i < extraRewards.length; i++) {

[G-02] Save Gas in For-Loops by storing array's length as a variable

3 gas per iteration can be saved by storing an array's length as a variable before the for-loop.

Issue found at:

BaseRewardPool.sol 176: for (uint256 i = 0; i < extraRewards.length; i++) { 199: for (uint256 i = 0; i < extraRewards.length; i++) { 218: for (uint256 i = 0; i < extraRewards.length; i++) { 245: for (uint256 i = 0; i < extraRewards.length; i++) { 282: for (uint256 i = 0; i < extraRewards.length; i++) { Booster.sol 329: for (uint256 i = 0; i < poolInfo.length; i++) { VE3DRewardPool.sol 148: for (uint256 i = 0; i < rewardTokens.length(); i++) { 281: for (uint256 i = 0; i < rewardTokens.length(); i++) {

For example, I suggest changing the ones for BaseRewardPool.sol to:

extraRewardsLength = extraRewards.length for (uint256 i; i < extraRewardsLength; i++) {

[G-03] ++i costs less gas than i++

It is better to use ++i than i++ when possible since it costs less gas. (Same for i-- as well)

Issue found at:

BaseRewardPool.sol 176: for (uint256 i = 0; i < extraRewards.length; i++) { 199: for (uint256 i = 0; i < extraRewards.length; i++) { 218: for (uint256 i = 0; i < extraRewards.length; i++) { 245: for (uint256 i = 0; i < extraRewards.length; i++) { 282: for (uint256 i = 0; i < extraRewards.length; i++) { Booster.sol 329: for (uint256 i = 0; i < poolInfo.length; i++) { VE3DRewardPool.sol 148: for (uint256 i = 0; i < rewardTokens.length(); i++) { 214: for (uint256 i = 0; i < length; i++) { 238: for (uint256 i = 0; i < length; i++) { 257: for (uint256 i = 0; i < length; i++) { 281: for (uint256 i = 0; i < rewardTokens.length(); i++) { 326: for (uint256 i = 0; i < length; i++) {

[G-04] Not Defining Variables to Reduce Gas Certain variables is not necessary so by removing it can save gas.

  1. Remove balance of stakeAll function at BaseRewardPool.sol Originally
189: function stakeAll() external returns (bool) { 190: uint256 balance = stakingToken.balanceOf(msg.sender); 191: stake(balance); 192: return true; 193: }

Can be changed to

function stakeAll() external returns (bool) { stake(stakingToken.balanceOf(msg.sender)); return true; }
  1. Remove elapsedTime, currentAtNow and queuedRatio at queueNewRewards function in BaseRewardPool.sol Originally
312: uint256 elapsedTime = block.timestamp.sub(periodFinish.sub(duration)); 313: //current at now: rewardRate * elapsedTime 314: uint256 currentAtNow = rewardRate * elapsedTime; 315: uint256 queuedRatio = currentAtNow.mul(1000).div(_rewards); 317: //uint256 queuedRatio = currentRewards.mul(1000).div(_rewards); 318: if (queuedRatio < newRewardRatio) {

Can be changed to

if ((rewardRate * (block.timestamp.sub(periodFinish.sub(duration)))).mul(1000).div(_rewards)) < newRewardRatio) {
  1. Remove remaining and leftover at notifyRewardAmount function in BaseRewardPool.sol Originally
332: uint256 remaining = periodFinish.sub(block.timestamp); 333: uint256 leftover = remaining.mul(rewardRate); 334: reward = reward.add(leftover);

Can be changed to

reward = reward.add((periodFinish.sub(block.timestamp)).mul(rewardRate));
  1. Remove balance at stakeAll function in VE3DRewardPool.sol Originally
228: function stakeAll() external { 229: uint256 balance = stakingToken.balanceOf(msg.sender); 230: stake(balance);

Can be changed to

function stakeAll() external { stake(stakingToken.balanceOf(msg.sender));
  1. Remove elapsedTime, currentAtNow and queuedRatio at queueNewRewards function in VE3DRewardPool.sol Originally
353: uint256 elapsedTime = block.timestamp.sub( 353: rewardTokenInfo[_rewardToken].periodFinish.sub(duration) 353: ); 353: //current at now: rewardRate * elapsedTime 353: uint256 currentAtNow = rewardTokenInfo[_rewardToken].rewardRate * elapsedTime; 353: uint256 queuedRatio = currentAtNow.mul(1000).div(_rewards); 353: if (queuedRatio < newRewardRatio) {

Can be changed to

if ((rewardTokenInfo[_rewardToken].rewardRate * (block.timestamp.sub(rewardTokenInfo[_rewardToken].periodFinish.sub(duration))).mul(1000).div(_rewards))
  1. Remove remaining and leftover at notifyRewardAmount function in VE3DRewardPool.sol Originally
375: uint256 remaining = rewardTokenInfo[_rewardToken].periodFinish.sub(block.timestamp); 376: uint256 leftover = remaining.mul(rewardTokenInfo[_rewardToken].rewardRate); 377: reward = reward.add(leftover);

Can be changed to

reward = reward.add(rewardTokenInfo[_rewardToken].periodFinish.sub(block.timestamp).mul(rewardTokenInfo[_rewardToken].rewardRate))
  1. Remove depositOnly at deposit function in VeAssetDepositor.sol Originally
154: bool depositOnly = _stakeAddress == address(0); 155: if (depositOnly) {

Can be changed to

if (_stakeAddress == address(0))
  1. Remove veAssetBal at depositAll function in VeAssetDepositor.sol
    Originally
174: uint256 veAssetBal = IERC20(veAsset).balanceOf(msg.sender); 175: deposit(veAssetBal, _lock, _stakeAddress);

Can be changed to

deposit(IERC20(veAsset).balanceOf(msg.sender), _lock, _stakeAddress)

[G-05] != 0 costs less gass then > 0

!= 0 costs less gas when optimizer is enabled and is used for unsigned integers in "require" statement. I suggest changing > 0 to != 0

Issue found at:

BaseRewardPool.sol: 196: require(_amount > 0, "RewardPool : Cannot stake 0"); 215: require(amount > 0, "RewardPool : Cannot withdraw 0"); VE3DRewardPool.sol 210: require(_amount > 0, "RewardPool : Cannot stake 0"); 234: require(_amount > 0, "RewardPool : Cannot stake 0"); 253: require(_amount > 0, "RewardPool : Cannot withdraw 0"); VeAssetDepositor.sol 132: require(_amount > 0, "!>0");

#0 - GalloDaSballo

2022-07-18T23:56:18Z

Will save less than 1k gas

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter