Illuminate contest - Tomio's results

Your Sole Source For Fixed-Yields.

General Information

Platform: Code4rena

Start Date: 21/06/2022

Pot Size: $55,000 USDC

Total HM: 29

Participants: 88

Period: 5 days

Judge: gzeon

Total Solo HM: 7

Id: 134

League: ETH

Illuminate

Findings Distribution

Researcher Performance

Rank: 65/88

Findings: 1

Award: $79.01

🌟 Selected for report: 0

🚀 Solo Findings: 0

Title: Custom errors from Solidity 0.8.4 are cheaper than revert strings

Impact: Custom errors from Solidity 0.8.4 are cheaper than revert strings (cheaper deployment cost and runtime cost when the revert condition is met) while providing the same amount of information

Custom errors are defined using the error statement reference: https://blog.soliditylang.org/2021/04/21/custom-errors/

Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L710-L712

Recommended Mitigation Steps: Replace require statements with custom errors.


Title: Use of uint8 in for loop increases gas costs

Proof of Concept: https://github.com/code-423n4/2022-03-lifinance/blob/main/src/Facets/HopFacet.sol#L48

Recommended Mitigation Steps: Change uint8 to uint256


  1. declare max in storage can save gas

Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L84 https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L112

Recommended Mitigation Steps: by declaring max in storage and make it constant can save about 5 gas


Title: Gas improvement on returning lent value

Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L258

Recommended Mitigation Steps: by set lent in returns L#255 and delete L#258 can save gas

) public unpaused(p) returns (uint256 lent) {

Title: >= is cheaper than >

Impact: Strict inequalities (>) are more expensive than non-strict ones (>=). This is due to some supplementary checks (ISZERO, 3 gas)

Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L681

Recommended Mitigation Steps: Consider using >= instead of > to avoid some opcodes

return feenominator >= 0 ? a / feenominator : 0;

Title: Consider make constant as private to save gas

Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L23

Recommended Mitigation Steps: I suggest changing the visibility from public to internal or private


Title: Set as immutable can save gas

Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L26

Recommended Mitigation Steps: can be set as immutable, which already set once in the constructor


Title: Comparison operators

Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20.sol#L116 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20.sol#L152 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20Permit.sol#L56

Recommended Mitigation Steps: Replace <= with <, and >= with > for gas opt


Title: Using += or -= can save gas

Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20.sol#L117-L118 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20.sol#L168-L169

Recommended Mitigation Steps: Change to:

unchecked { _balanceOf[src] -= wad; } _balanceOf[dst] += wad;

Title: Using multiple require instead of && can save gas

Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20Permit.sol#L78-L81

Recommended Mitigation Steps: Change to:

require(signer != address(0), "ERC20Permit: invalid signature"); require(signer == owner, "ERC20Permit: invalid signature");

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter