Sherlock contest - Tomio's results

Handle

Tomio

Vulnerability details

Impact

Expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/managers/SherlockClaimManager.sol#L184

Tools Used

Remix

Recommended Mitigation Steps

Change:

claims_[_claimIdentifier].state = _state;
claims_[_claimIdentifier].updated = block.timestamp;

To:

claim.state = _state;
claim.updated = block.timestamp;

Handle

Tomio

Vulnerability details

Impact

because if there's no check address(this).balance != 0 then doesnt need to call transfer, can save gas

Proof of Concept

https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/managers/Manager.sol#L51

Tools Used

Remix

Recommended Mitigation Steps

Example: If transfer first:

function sendETH(address _receive) external payable { 
        (bool success, ) = _receive.call{value: address(this).balance}('');
        if(success == false) require(false, "Transfer ETH Failed");
    }
// 22276 gas

If check address(this).balance first

function correctSendEth(address _receive) external payable {
        uint eth_balance = address(this).balance;
        if (eth_balance != 0){
            (bool success, ) = _receive.call{value: eth_balance}('');
            if(success == false) require(false, "Transfer ETH Failed");
        }

    }
//21923 gas

Handle

Tomio

Vulnerability details

Impact

In the https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/SherBuy.sol#L181 receiver can sweep the token, by inputing all of the address that this contract has, since the _tokens parameter is not going to be changed in this function, its cheaper to use calldata than memory

Proof of Concept

function sweepTokens(IERC20[] calldata _tokens) external {
        //if (msg.sender != receiver) revert InvalidSender();
        //if (active()) revert InvalidState();

    // Loops through the extra tokens (ERC20) provided and sends all of them to the sender address
        for (uint256 i; i < _tokens.length; i++) {
            counter += 1;
            //IERC20 token = _tokens[i];
            //token.safeTransfer(msg.sender, token.balanceOf(address(this)));
        }
    }
    // 48066 using memory
    // 46686 using calldata