Juicebox V2 contest - Tomio's results

The decentralized fundraising and treasury protocol.

General Information

Platform: Code4rena

Start Date: 01/07/2022

Pot Size: $75,000 USDC

Total HM: 17

Participants: 105

Period: 7 days

Judge: Jack the Pug

Total Solo HM: 5

Id: 143

League: ETH

Juicebox

Findings Distribution

Researcher Performance

Rank: 86/105

Findings: 1

Award: $38.24

🌟 Selected for report: 0

🚀 Solo Findings: 0

Title: >= is cheaper than >

Impact: Strict inequalities (>) are more expensive than non-strict ones (>=). This is due to some supplementary checks (ISZERO, 3 gas)

Proof of Concept: JBFundingCycleStore.sol#L340 JBFundingCycleStore.sol#L427

Recommended Mitigation Steps: Consider using >= instead of > to avoid some opcodes


Title: Default value initialization

Impact: If a variable is not set/initialized, it is assumed to have the default value (0, false, 0x0 etc depending on the data type). Explicitly initializing it with its default value is an anti-pattern and wastes gas.

Proof of Concept: JBFundingCycleStore.sol#L724 JBProjects.sol#L40 JBSplitsStore.sol#L209 JBSplitsStore.sol#L227

Recommended Mitigation Steps: Remove explicit initialization for default values.


Title: Caching length for loop can save gas

Proof of Concept: JBSplitsStore.sol#L211 JBSplitsStore.sol#L229 JBOperatorStore.sol#L85 JBOperatorStore.sol#L135 JBOperatorStore.sol#L165

Recommended Mitigation Steps: Change to:

uint256 Length = _splits.length; for (uint256 _i = 0; _i < Length; _i++) {

Title: Using unchecked and prefix increment is more effective for gas saving:

Proof of Concept: JBSplitsStore.sol#L204 JBSplitsStore.sol#L211 JBSplitsStore.sol#L229

Recommended Mitigation Steps: Change to:

for (uint256 _i = 0; _i < _currentSplits.length;) { // ... unchecked { ++i; } }

itle: Comparison operators

Proof of Concept: JBSplitsStore.sol#L206

Recommended Mitigation Steps: Replace <= with <, and >= with > for gas optimization


Title: Using += or -= can save gas

Proof of Concept: JBSplitsStore.sol#L237 JBPayoutRedemptionPaymentTerminal.sol#L960

Recommended Mitigation Steps: Change to:

_percentTotal += _splits[_i].percent;

Title: Consider make constant as private to save gas

Proof of Concept: JBPayoutRedemptionPaymentTerminal.sol#L87-L93 JBSingleTokenPaymentTerminalStore.sol#L51

Recommended Mitigation Steps: I suggest changing the visibility from public to internal or private


Title: Using unchecked can save gas

Proof of Concept: JBSingleTokenPaymentTerminalStore.sol#L834)

Recommended Mitigation Steps:

unchecked{ return _balanceOf > _distributionLimitRemaining ? _balanceOf - _distributionLimitRemaining : 0; }

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter