ENS contest - Tomio's results

Decentralised naming for wallets, websites, & more.

General Information

Platform: Code4rena

Start Date: 12/07/2022

Pot Size: $75,000 USDC

Total HM: 16

Participants: 100

Period: 7 days

Judge: LSDan

Total Solo HM: 7

Id: 145

League: ETH

ENS

Findings Distribution

Researcher Performance

Rank: 85/100

Findings: 1

Award: $44.30

🌟 Selected for report: 0

🚀 Solo Findings: 0

Title: Gas savings for using solidity 0.8.10

Proof of Concept: all contract

Recommended Mitigation Steps: Consider to upgrade pragma to at least 0.8.10.

Solidity 0.8.10 has a useful change which reduced gas costs of external calls Reference: here


Title: Using multiple require instead && can save gas

Proof of Concept: ERC1155Fuse.sol#L215-L218 ERC1155Fuse.sol#L290-L293

Recommended Mitigation Steps:

require(amount == 1 ,"ERC1155: insufficient balance for transfer"); require(oldOwner == from,"ERC1155: insufficient balance for transfer");

Title: Reduce the size of error messages (Long revert Strings)

Impact: Shortening revert strings to fit in 32 bytes will decrease deployment time gas and will decrease runtime gas when the revert condition is met. Revert strings that are longer than 32 bytes require at least one additional mstore, along with additional overhead for computing memory offset, etc.

Proof of Concept: ERC1155Fuse.sol (various line) ReverseRegistrar.sol#L46 ReverseRegistrar.sol#L52-L55

Recommended Mitigation Steps: Consider shortening the revert strings to fit in 32 bytes


Title: Custom errors from Solidity 0.8.4 are cheaper than revert strings

Impact: Custom errors from Solidity 0.8.4 are cheaper than revert strings (cheaper deployment cost and runtime cost when the revert condition is met) while providing the same amount of information

Custom errors are defined using the error statement reference: https://blog.soliditylang.org/2021/04/21/custom-errors/

Proof of Concept: ERC1155Fuse.sol (various line) ReverseRegistrar.sol#L52-L55

Recommended Mitigation Steps: Replace require statements with custom errors.


Title: Set as immutable can save gas

Proof of Concept: Owned.sol#L7

Recommended Mitigation Steps: can be set as immutable, which already set once in the constructor


Title: Consider make constant as private to save gas

Proof of Concept: ETHRegistrarController.sol#L21

Recommended Mitigation Steps: I suggest changing the visibility from public to internal or private


Title: abi.encode() is less efficient than abi.encodePacked()

Proof of Concept: ETHRegistrarController.sol#L106


Title: Comparison operators

Proof of Concept: ETHRegistrarController.sol#L138 ETHRegistrarController.sol#L197 ETHRegistrarController.sol#L246

Recommended Mitigation Steps: Replace <= with <, and >= with > for gas optimization


Title: function register(): L#184 should be unchecked due to L#182

Proof of Concept: ETHRegistrarController.sol#L184

Recommended Mitigation Steps: Use unchecked


Title: Caching length for loop can save gas

Proof of Concept: ETHRegistrarController.sol#L256

Recommended Mitigation Steps: Change to:

uint256 Length = data.length; for (uint256 i = 0; i < Length; i++) {

Title: Using unchecked and prefix increment is more effective for gas saving:

Proof of Concept: ETHRegistrarController.sol#L256

Recommended Mitigation Steps: Change to:

for (uint256 i = 0; i < data.length;) { // ... unchecked { ++i; } }

Title: function renew(): L#204 should be unchecked due to L#203

Proof of Concept: ETHRegistrarController.sol#L204

Recommended Mitigation Steps: Use unchecked


Title: Gas improvement on returning count value

Proof of Concept: RRUtils.sol#L50

Recommended Mitigation Steps: by set count in returns L#49 and delete L#50 can save gas

function labelCount(bytes memory self, uint offset) internal pure returns(uint count) { //@audit-info: set here uint count = 0; //@audit-info: delete this

Title: Using storage to declare Struct variable inside function

Proof of Concept: RRUtils.sol#L97 RRUtils.sol#L131 RRUtils.sol#L139

Recommended Mitigation Steps:

function rrs(SignedSet storage rrset) internal pure returns(RRIterator memory) {

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter