JPEG'd contest - Tomio's results

Bridging the gap between DeFi and NFTs.

General Information

Platform: Code4rena

Start Date: 07/04/2022

Pot Size: $100,000 USDC

Total HM: 20

Participants: 62

Period: 7 days

Judge: LSDan

Total Solo HM: 11

Id: 107

League: ETH

JPEG'd

Findings Distribution

Researcher Performance

Rank: 50/62

Findings: 1

Award: $138.25

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

138.2493 USDC - $138.25

Labels

bug
G (Gas Optimization)
sponsor acknowledged

External Links

  1. Using require instead of && can save gas

Proof of Concept: https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/vaults/FungibleAssetVaultForDAO.sol#L194 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/escrow/NFTEscrow.sol#L86-L89 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/staking/JPEGStaking.sol#L45-L48

Recommended Mitigation Steps: Change to:

require(amount > 0, "invalid_amount"); require(amount <= collateralAmount, "invalid_amount");

========================================================================

  1. !=0 is more gas efficient than > 0

Proof of Concept: https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/farming/LPFarming.sol#L114 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/farming/LPFarming.sol#L218 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/farming/LPFarming.sol#L239 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/farming/LPFarming.sol#L337

Recommended Mitigation Steps: Change > 0 or < 0 to != 0

========================================================================

  1. Using > is cheaper than >=

Proof of Concept: https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/vaults/FungibleAssetVaultForDAO.sol#L197 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/farming/LPFarming.sol#L112 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/farming/LPFarming.sol#L243

Recommended Mitigation Steps: Change from >= to >

========================================================================

  1. Using immutable which set once at constructor can save gas

Proof of Concept: https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/vaults/yVault/strategies/StrategyPUSDConvex.sol#L75-L78

Recommended Mitigation Steps: add immutable

========================================================================

  1. unnecessary value set. the default value of uint is zero.

Proof of Concept: https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/farming/LPFarming.sol#L348 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/vaults/NFTVault.sol#L181

Recommended Mitigation Steps: remove 0

========================================================================

  1. Better increment

Proof of Concept: https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/farming/LPFarming.sol#L348 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/vaults/NFTVault.sol#L181

Recommended Mitigation Steps: change i++ to ++i

========================================================================

  1. Using calldata to store struct data type (Rate, NFTCategoryInitializer, Position.. ) can save gas

Proof of Concept: https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/vaults/NFTVault.sol#L182 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/vaults/NFTVault.sol#L212 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/vaults/NFTVault.sol#L222 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/vaults/NFTVault.sol#L880 https://github.com/code-423n4/2022-04-jpegd/blob/main/contracts/vaults/NFTVault.sol#L923

Recommended Mitigation Steps: Change memory to calldata

========================================================================

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter