InsureDAO contest - Tomio's results

Handle

Tomio

Vulnerability details

Impact

by using 'unchecked' you can save +-182 gas

Proof of Concept

before: https://github.com/code-423n4/2022-01-insure/blob/main/contracts/PoolTemplate.sol#L938 //22378 before

after:

function _sub(uint256 a, uint256 b) public pure returns (uint256) {
        if (a < b) {
            return 0;
        } else {
            unchecked {return a - b;}
        }
    }  

//22196 after

Tools Used

Remix

Recommended Mitigation Steps

used 'unchecked' in function _sub

Handle

Tomio

Vulnerability details

Impact

by changing the code from if (_credit == 0) { to if (_credit != 0) { and remove the else we can save gas when contract is deploy and we can save gas when _credit is equal to 0. because if _credit equal to 0 the original function will return 0 which a default value for uint256

Proof of Concept

Before: https://github.com/code-423n4/2022-01-insure/blob/main/contracts/PoolTemplate.sol#L776 // gas 24307

After:

function pendingPremium(address _index)
        external
        view
        returns (uint256)
    {
        uint256 _credit = indicies[_index].credit;
       if (_credit != 0) {
            return
                _sub(
                    (_credit * rewardPerCredit) / MAGIC_SCALE_1E6,
                    indicies[_index].rewardDebt
                );
        }
    }

// gas 24286

Tools Used

Remix

Recommended Mitigation Steps

Handle

Tomio

Vulnerability details

Impact

by saving totalLiquidity() to memory can save more gas instead of doing double function call

Proof of Concept

Before: https://github.com/code-423n4/2022-01-insure/blob/main/contracts/PoolTemplate.sol#L829 // gas cost 23862

After:

function totalLiquidity() public view returns (uint256){
     return 10;
 }   

function availableBalance()public view returns (uint256 _balance)
    {
        uint256 saveTotalLiquidity = totalLiquidity();
        if (saveTotalLiquidity > 0) {
            return saveTotalLiquidity - lockedAmount;
        } else {
            return 0;
        }
    }

// gas cost 23840

Tools Used

Remix

Handle

Tomio

Vulnerability details

Impact

expensive gas

Proof of Concept

Before: https://github.com/code-423n4/2022-01-insure/blob/main/contracts/IndexTemplate.sol#L164 // gas 21512

Tools Used

Remix

Recommended Mitigation Steps

function deposit(uint256 _amount) public returns (uint256 _mintAmount ) {

        uint256 _supply = 0;
        uint256 _totalLiquidity = 10;

        _mintAmount = _amount;

        if (_supply > 0 ){
            if (_totalLiquidity == 0){
                _mintAmount = _amount * _supply;
            }else{
                _mintAmount = (_amount * _supply) / _totalLiquidity;
            }
        }
    }

/// 21444

Handle

Tomio

Vulnerability details

Impact

gas cost more by using true check in require templates[address(_template)].approval == true change to templates[address(_template)].approval because the require check expected a true value from templates[address(_template)].approval

Proof of Concept

https://github.com/code-423n4/2022-01-insure/blob/main/contracts/Factory.sol#L158 //gas 28518 before

function createMarket(
        IUniversalMarket _template,
        string memory _metaData,
        uint256[] memory _conditions,
        address[] memory _references
    ) public returns (address) {
        //check eligibility
        require(
            templates[address(_template)].approval,
            "ERROR: UNAUTHORIZED_TEMPLATE"
        );
    } 
}
// gas 28500 after

Tools Used

Remix

Recommended Mitigation Steps

Handle

Tomio

Vulnerability details

Impact

using double require instead of operator && can save more gas

Proof of Concept

https://github.com/code-423n4/2022-01-insure/blob/main/contracts/Vault.sol#L154

Recommended Mitigation Steps

example:

using &&:

function check(uint x)public view{
    require(x == 0 && x < 1 );
}

// gas cost 21630

using double require:

    require(x == 0 );
    require( x < 1);
    }
}
// gas cost 21622

Handle

Tomio

Vulnerability details

Impact

The default value is already 0, so by not redeclare 0 value can save a little bit more gas

Proof of Concept

https://github.com/code-423n4/2022-01-insure/blob/main/contracts/IndexTemplate.sol#L280 https://github.com/code-423n4/2022-01-insure/blob/main/contracts/IndexTemplate.sol#L348 https://github.com/code-423n4/2022-01-insure/blob/main/contracts/IndexTemplate.sol#L381 https://github.com/code-423n4/2022-01-insure/blob/main/contracts/IndexTemplate.sol#L462 https://github.com/code-423n4/2022-01-insure/blob/main/contracts/IndexTemplate.sol#L655

Tools Used

Manual review

Recommended Mitigation Steps

remove 0 value from: for (uint256 i = 0; to: for (uint256 i;