FactoryDAO contest - Tomio's results

The DAO that builds DAOs.

General Information

Platform: Code4rena

Start Date: 04/05/2022

Pot Size: $50,000 DAI

Total HM: 24

Participants: 71

Period: 5 days

Judge: Justin Goro

Total Solo HM: 14

Id: 119

League: ETH

FactoryDAO

Findings Distribution

Researcher Performance

Rank: 60/71

Findings: 1

Award: $43.09

🌟 Selected for report: 0

🚀 Solo Findings: 0

Title: Using != is more gas efficient

Proof of Concept: https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/FixedPricePassThruGate.sol#L51 https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/MerkleResistor.sol#L175

Recommended Mitigation Steps: Change to !=0

========================================================================

Title: Using > is cheaper than >=

Proof of Concept: https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/FixedPricePassThruGate.sol#L48 https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/MerkleResistor.sol#L179

Recommended Mitigation Steps: just use > can save gas

========================================================================

Title: unnecessary value set. the default value of uint is 0.

Proof of Concept: https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/MerkleDropFactory.sol#L17 https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/MerkleEligibility.sol#L31 https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/MerkleResistor.sol#L176

Recommended Mitigation Steps: remove 0 value can save gas

========================================================================

Title: Caching .length for loop can save gas

Proof of Concept: https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/MerkleLib.sol#L22 https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/PermissionlessBasicPoolFactory.sol#L115

Recommended Mitigation Steps: Change to:

uint256 Length = proof.length; for (uint i = 0; i < Length; i += 1) {

========================================================================

Title: Using calldata on struct parameter

Proof of Concept: https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/PermissionlessBasicPoolFactory.sol#L95

Recommended Mitigation Steps: Using calldata to store struct data type can save gas

uint[] calldata rewardsWeiPerSecondPerToken,

========================================================================

Title: Using delete statement to empty pool.rewardFunding can save gas

Proof of Concept: https://github.com/fei-protocol/flywheel-v2/blob/77bfadf388db25cf5917d39cd9c0ad920f404aad/src/FlywheelCore.sol#L123 https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/PermissionlessBasicPoolFactory.sol#L268

Recommended Mitigation Steps: Change to:

delete pool.rewardFunding[i];

========================================================================

Title: Using += to increase value on var

Proof of Concept: https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/VoterID.sol#L130 https://github.com/code-423n4/2022-05-factorydao/blob/main/contracts/VoterID.sol#L140

Recommended Mitigation Steps: Change to:

numIdentities += 1; balances[thisOwner] += 1;

========================================================================

#0 - illuzen

2022-05-12T08:57:39Z

all duplicates

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter