OpenLeverage contest - Tomio's results

Handle

Tomio

Vulnerability details

Impact

Expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L125 // gas cost 26406

Tools Used

Remix

Recommended Mitigation Steps

Change to:

 function getRewards(address[] calldata stakeTokens) external {
     uint256 tesstakeTokens = stakeTokens.length;
        for (uint256 i = 0; i < tesstakeTokens; i++) {
            getReward(stakeTokens[i]);
        }
    }
// gas cost 26247

Handle

Tomio

Vulnerability details

Impact

Expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/XOLE.sol#L326 // gas cost 26049

Tools Used

Remix

Recommended Mitigation Steps

Change to:

LockedBalance storage _locked = locked[msg.sender];
// gas cost 25954

and remove https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/XOLE.sol#L333, not needed if use storage

Handle

Tomio

Vulnerability details

Impact

Expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/OLETokenLock.sol#L28 testing:

require(beneficiaries.length == amounts.length
        && beneficiaries.length == startTimes.length
            && beneficiaries.length == endTimes.length, "Array length must be same");
//gas cost 90411

Tools Used

Remix

Recommended Mitigation Steps

Change to:

require(beneficiaries.length == amounts.length);
        require (beneficiaries.length == startTimes.length);
        require (beneficiaries.length == endTimes.length, "Array length must be same");
//gas cost 90403