FIAT DAO veFDT contest - Tomio's results

Unlock liquidity for your DeFi fixed income assets.

General Information

Platform: Code4rena

Start Date: 12/08/2022

Pot Size: $35,000 USDC

Total HM: 10

Participants: 126

Period: 3 days

Judge: Justin Goro

Total Solo HM: 3

Id: 154

League: ETH

FIAT DAO

Findings Distribution

Researcher Performance

Rank: 108/126

Findings: 1

Award: $15.03

🌟 Selected for report: 0

🚀 Solo Findings: 0

Title: Consider make constant as private to save gas

Proof of Concept: VotingEscrow.sol#L46-L48

Recommended Mitigation Steps: I suggest changing the visibility from public to internal or private


Title: Set as immutable can save gas

Proof of Concept: Blocklist.sol#L11-L12 VotingEscrow.sol#L64-L66

Recommended Mitigation Steps: can be set as immutable, which already set once in the constructor


Title: Gas savings for using solidity 0.8.10

Proof of Concept: Blocklist.sol#L2 VotingEscrow.sol#L2 IBlocklist.sol#L2 IVotingEscrow.sol#L2 IERC20.sol#L2

Recommended Mitigation Steps: Consider to upgrade pragma to at least 0.8.10.

Solidity 0.8.10 has a useful change which reduced gas costs of external calls Reference: here


Title: Using != in require statement is more gas efficient

Proof of Concept: VotingEscrow.sol#L412 VotingEscrow.sol#L448-L449 VotingEscrow.sol#L469 VotingEscrow.sol#L502

Recommended Mitigation Steps: Change > 0 to != 0


Title: Gas improvement on returning min value

Proof of Concept: VotingEscrow.sol#L714

Recommended Mitigation Steps: by set min in returns L#711 and delete L#714 can save gas

function _findBlockEpoch(uint256 _block, uint256 _maxEpoch) internal view returns (uint256 min) //@audit-info: set `min` here { // Binary search uint256 min = 0; //@audit-info: delete this L#714

Title: Gas optimization to dividing by 2

Proof of Concept: VotingEscrow.sol#L719

Recommended Mitigation Steps: Replace / 2 with >> 1

Reference: here


Title: Default value initialization

Impact: If a variable is not set/initialized, it is assumed to have the default value (0, false, 0x0 etc depending on the data type). Explicitly initializing it with its default value is an anti-pattern and wastes gas.

Proof of Concept: VotingEscrow.sol#L298 VotingEscrow.sol#L309 VotingEscrow.sol#L714

Recommended Mitigation Steps: Remove explicit initialization for default values.


Title: Using unchecked and prefix increment is more effective for gas saving:

Proof of Concept: VotingEscrow.sol#L309 VotingEscrow.sol#L739

Recommended Mitigation Steps: Change to:

for (uint256 i = 0; i < 255;) { // ... unchecked { ++i; } }

Title: Comparison operators

Proof of Concept: VotingEscrow.sol#L414 VotingEscrow.sol#L504

Recommended Mitigation Steps: Replace <= with <, and >= with > for gas optimization


10 Title: calldata instead of memory for RO function parameters

Impact: If a reference type function parameter is read-only, it is cheaper in gas to use calldata instead of memory. Calldata is a non-modifiable, non-persistent area where function arguments are stored, and behaves mostly like memory.

Try to use calldata as a data location because it will avoid copies and also makes sure that the data cannot be modified.

Proof of Concept: VotingEscrow.sol#L224-L225 VotingEscrow.sol#L685 VotingEscrow.sol#L825

Recommended Mitigation Steps: Replace memory with calldata


Title: Using storage instead of memory for struct can save gas

Proof of Concept: VotingEscrow.sol#L172 VotingEscrow.sol#L214

Recommended Mitigation Steps: Replace memory with storage


Title: Using += or -= can save gas

Proof of Concept: VotingEscrow.sol#L312 VotingEscrow.sol#L380 VotingEscrow.sol#L382 VotingEscrow.sol#L388 VotingEscrow.sol#L853

Recommended Mitigation Steps: Change to:

oldSlopeDelta -= userNewPoint.slope;

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter