Platform: Code4rena
Start Date: 21/06/2022
Pot Size: $55,000 USDC
Total HM: 29
Participants: 88
Period: 5 days
Judge: gzeon
Total Solo HM: 7
Id: 134
League: ETH
Rank: 65/88
Findings: 1
Award: $79.01
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: BowTiedWardens
Also found by: 0v3rf10w, 0x1f8b, 0x29A, 0xKitsune, 0xNazgul, 0xf15ers, 0xkatana, 0xkowloon, Bnke0x0, ElKu, Fitraldys, Funen, GalloDaSballo, IllIllI, JC, Kaiziron, Lambda, MadWookie, Noah3o6, Nyamcil, RoiEvenHaim, TomJ, Tomio, UnusualTurtle, Waze, _Adam, ajtra, asutorufos, bardamu, c3phas, catchup, datapunk, defsec, delfin454000, fatherOfBlocks, grGred, hake, hansfriese, hyh, ignacio, joestakey, kebabsec, ladboy233, oyc_109, pashov, poirots, rfa, robee, sach1r0, samruna, sashik_eth, simon135, slywaters, z3s, zer0dot
79.0114 USDC - $79.01
Title: Custom errors from Solidity 0.8.4 are cheaper than revert strings
Impact: Custom errors from Solidity 0.8.4 are cheaper than revert strings (cheaper deployment cost and runtime cost when the revert condition is met) while providing the same amount of information
Custom errors are defined using the error statement reference: https://blog.soliditylang.org/2021/04/21/custom-errors/
Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L710-L712
Recommended Mitigation Steps: Replace require statements with custom errors.
Title: Use of uint8
in for loop increases gas costs
Proof of Concept: https://github.com/code-423n4/2022-03-lifinance/blob/main/src/Facets/HopFacet.sol#L48
Recommended Mitigation Steps:
Change uint8
to uint256
max
in storage can save gasProof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L84 https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L112
Recommended Mitigation Steps:
by declaring max
in storage and make it constant
can save about 5 gas
Title: Gas improvement on returning lent
value
Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L258
Recommended Mitigation Steps:
by set lent
in returns L#255 and delete L#258 can save gas
) public unpaused(p) returns (uint256 lent) {
Title: >=
is cheaper than >
Impact:
Strict inequalities (>
) are more expensive than non-strict ones (>=
). This is due to some supplementary checks (ISZERO, 3 gas)
Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L681
Recommended Mitigation Steps:
Consider using >=
instead of >
to avoid some opcodes
return feenominator >= 0 ? a / feenominator : 0;
Title: Consider make constant as private to save gas
Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L23
Recommended Mitigation Steps:
I suggest changing the visibility from public
to internal
or private
Title: Set as immutable
can save gas
Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/lender/Lender.sol#L26
Recommended Mitigation Steps: can be set as immutable, which already set once in the constructor
Title: Comparison operators
Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20.sol#L116 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20.sol#L152 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20Permit.sol#L56
Recommended Mitigation Steps:
Replace <=
with <
, and >=
with >
for gas opt
Title: Using +=
or -=
can save gas
Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20.sol#L117-L118 https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20.sol#L168-L169
Recommended Mitigation Steps: Change to:
unchecked { _balanceOf[src] -= wad; } _balanceOf[dst] += wad;
Title: Using multiple require
instead of &&
can save gas
Proof of Concept: https://github.com/code-423n4/2022-06-illuminate/blob/main/marketplace/ERC20Permit.sol#L78-L81
Recommended Mitigation Steps: Change to:
require(signer != address(0), "ERC20Permit: invalid signature"); require(signer == owner, "ERC20Permit: invalid signature");