PartyDAO contest - Tomio's results

A protocol for buying, using, and selling NFTs as a group.

General Information

Platform: Code4rena

Start Date: 12/09/2022

Pot Size: $75,000 USDC

Total HM: 19

Participants: 110

Period: 7 days

Judge: HardlyDifficult

Total Solo HM: 9

Id: 160

League: ETH

PartyDAO

Findings Distribution

Researcher Performance

Rank: 84/110

Findings: 1

Award: $35.63

🌟 Selected for report: 0

🚀 Solo Findings: 0

Title: Consider remove empty block

impact: The code should be refactored such that they no longer exist, or the block should do something useful, such as emitting an event or reverting.

Proof of Concept: Party.sol#L47 AuctionCrowdfund.sol#L144


Title: Expression for constant values such as a call to keccak256(), should use immutable rather than constant

Proof of Concept: ProposalStorage.sol#L19

Recommended Mitigation Steps: Change from constant to immutable reference: here


Title: Comparison operators

Proof of Concept: ArbitraryCallsProposal.sol#L156 Crowdfund.sol#L423

Recommended Mitigation Steps: Change to:

if (call.data.length > 3) {

Replace <= with <, and >= with > for gas optimization


Title: abi.encode() is less efficient than abi.encodePacked()

Proof of Concept: ListOnZoraProposal.sol#L115


Title: >= is cheaper than >

Impact: Strict inequalities (>) are more expensive than non-strict ones (>=). This is due to some supplementary checks (ISZERO, 3 gas)

Proof of Concept: TokenDistributor.sol#L167

Recommended Mitigation Steps: Consider using >= instead of > to avoid some opcodes


Title: Using unchecked can save gas

Proof of Concept: TokenDistributor.sol#L167-L170

Recommended Mitigation Steps: using unchecked can save gas (because amountClaimed > remainingMemberSupply)


Title: Caching length for loop can save gas

Proof of Concept: TokenDistributor.sol#L239 TokenDistributor.sol#L230 ListOnOpenseaProposal.sol#L291 crowdfund/Crowdfund.sol#L180

Recommended Mitigation Steps: Change to:

uint256 Length = infos.length; for (uint256 i = 0; i < Length; ++i) {

Title: Using unchecked and prefix increment is more effective for gas saving:

Proof of Concept: TokenDistributor.sol#L239 TokenDistributor.sol#L230 ListOnOpenseaProposal.sol#L291 crowdfund/Crowdfund.sol#L180

Recommended Mitigation Steps: Change to:

for (uint256 i = 0; i < infos.length;) { // ... unchecked { ++i; } }

Title: Default value initialization

Impact: If a variable is not set/initialized, it is assumed to have the default value (0, false, 0x0 etc depending on the data type). Explicitly initializing it with its default value is an anti-pattern and wastes gas.

Proof of Concept: TokenDistributor.sol#L239 TokenDistributor.sol#L230 ListOnOpenseaProposal.sol#L291 crowdfund/Crowdfund.sol#L180 PartyGovernance.sol#L432

Recommended Mitigation Steps: Remove explicit initialization for default values.


Title: calldata instead of memory for RO function parameters

Impact: If a reference type function parameter is read-only, it is cheaper in gas to use calldata instead of memory. Calldata is a non-modifiable, non-persistent area where function arguments are stored, and behaves mostly like memory.

Try to use calldata as a data location because it will avoid copies and also makes sure that the data cannot be modified.

Proof of Concept: BuyCrowdfundBase.sol#L70

Recommended Mitigation Steps: Replace memory with calldata


Title: function _getFinalContribution(): L#358 should be unchecked due to L#350

Proof of Concept: Crowdfund.sol#L358

Recommended Mitigation Steps: Use unchecked


Title: Gas optimization for increment or decrement

Proof of Concept: Title: Cheaper to use ++ instead + 1

Proof of Concept: PartyGovernance.sol#L440

Recommended Mitigation Steps: instead of using +1 replace it with ++

low = ++mid;

Title: Gas optimization to dividing by 2

Proof of Concept: PartyGovernance.sol#L434

Recommended Mitigation Steps: Replace / 2 with >> 1

Reference: here


Title: using delete statement can save gas

Proof of Concept: PartyGovernance.sol#L708

Recommended Mitigation Steps: Change to:

delete proposalState.values.completedTime;

Title: Gas savings for using solidity 0.8.10

Proof of Concept: All contract in scope

Recommended Mitigation Steps: Consider to upgrade pragma to at least 0.8.10.

Solidity 0.8.10 has a useful change which reduced gas costs of external calls Reference: here


AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter