Rigor Protocol contest - Tomio's results

Community lending and instant payments for new home construction.

General Information

Platform: Code4rena

Start Date: 01/08/2022

Pot Size: $50,000 USDC

Total HM: 26

Participants: 133

Period: 5 days

Judge: Jack the Pug

Total Solo HM: 6

Id: 151

League: ETH

Rigor Protocol

Findings Distribution

Researcher Performance

Rank: 83/133

Findings: 2

Award: $62.34

🌟 Selected for report: 0

🚀 Solo Findings: 0

Title: Custom errors from Solidity 0.8.4 are cheaper than revert strings

Impact: Custom errors from Solidity 0.8.4 are cheaper than revert strings (cheaper deployment cost and runtime cost when the revert condition is met) while providing the same amount of information

Custom errors are defined using the error statement reference: https://blog.soliditylang.org/2021/04/21/custom-errors/

Proof of Concept: Tasks.sol#L124 Community.sol (various line)

Recommended Mitigation Steps: Replace require statements with custom errors.


Title: Default value initialization

Impact: If a variable is not set/initialized, it is assumed to have the default value (0, false, 0x0 etc depending on the data type). Explicitly initializing it with its default value is an anti-pattern and wastes gas.

Proof of Concept: Tasks.sol#L181 Community.sol#L624 Project.sol#L412

Recommended Mitigation Steps: Remove explicit initialization for default values.


Title: Using unchecked and prefix increment is more effective for gas saving:

Proof of Concept: Tasks.sol#L181 Community.sol#L624

Recommended Mitigation Steps: Change to:

for (uint256 i = 0; i < _length;) _alerts[i] = _self.alerts[i]; unchecked { ++i; } }

Title: Gas savings for using solidity 0.8.10

Proof of Concept: all contract

Recommended Mitigation Steps: Consider to upgrade pragma to at least 0.8.10.

Solidity 0.8.10 has a useful change which reduced gas costs of external calls Reference: here


Title: Using multiple require instead && can save gas

Proof of Concept: Community.sol#L353-L357 Disputes.sol#L107

Recommended Mitigation Steps:

require(_lendingNeeded >= _communityProject.totalLent, "Community::invalid lending"); require(_lendingNeeded <= IProject(_project).projectCost(), "Community::invalid lending");

Title: Comparison operators

Proof of Concept: Community.sol#L353-L357 Community.sol#L792

Recommended Mitigation Steps: Replace <= with <, and >= with > for gas optimization


Title: Using != is more gas efficient in require statement

Proof of Concept: Community.sol#L764 Project.sol#L195 Disputes.sol#L107

Recommended Mitigation Steps: Change to !=

require(_repayAmount != 0, "Community::!repay");

Title: Use unchecked can save gas

Proof of Concept: Community.sol#L794 (because of require() L#792) Community.sol#L798(because of if() L#785) Project.sol#L427(because of if() L#425) Project.sol#L616(because of if() L#614)

Recommended Mitigation Steps: Use unchecked


Title: Consider make constant as private to save gas

Proof of Concept: Project.sol#L60

Recommended Mitigation Steps: I suggest changing the visibility from public to internal or private


AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter