Nouns Builder contest - WatchDogs's results

A permissionless, governed protocol to deploy nouns-style DAOs complete with treasury, generative collections, and governance mechanisms.

General Information

Platform: Code4rena

Start Date: 06/09/2022

Pot Size: $90,000 USDC

Total HM: 33

Participants: 168

Period: 9 days

Judge: GalloDaSballo

Total Solo HM: 10

Id: 157

League: ETH

Nouns Builder

Findings Distribution

Researcher Performance

Rank: 151/168

Findings: 1

Award: $46.69

🌟 Selected for report: 0

šŸš€ Solo Findings: 0

[Gas - 01] >= cost more than >

A single > operator costs less gas as compared to the >= operator.

Instances of this issue :

  • Auction.sol L98
  • Treasury.sol L89
  • ERC721Votes.sol L61

[G - 02] Add payable to functions that won't receive ETH

OnlyOwner functions cannot be called by normal users and will not receive ETH by mistake. To save gas, these functions can be made payable.

Instances of this issue :

[Gas - 03] Using bool s for storage incurs overhead

It costs more to declare storage variables as bools than as uint256.

Instances of this issue :

  • GovernorStorageV1.sol L19
  • ERC721.sol L38
  • ManagerStorageV1.sol L10
  • Auction.sol L136 L349
  • ERC1967Upgrade.sol L57

[Gas - 04] For array parameters in functions, it is recommended to useĀ calldata overĀ memory

When an external function with aĀ memory array is called, theĀ abi.decode() step has to use a for-loop to copy each index of theĀ calldata to theĀ memoryĀ index. Each iteration of this for-loop costs at least 60 gas (i.e.Ā 60 * <mem_array>.length).

Change the following from memory to calldata :

[Gas - 05] No need to explicitly initialize variables with default values

Declaration of variables with default values cost gas. such as

uint256 a = 0; change to → uint256 a;

Instances of this issue :

[Gas - 06] Use Shift Right/Left instead of Division/Multiplication if possible

Change the following from:

uint256 b = a / 2; → uint256 b = a >> 1;

  • ERC721Votes.sol L95

[Gas - 07] Use ++x instead of x++

Use Prefix increment rather than Postfix increment, it saves gas.

Instances of this issue :

[Gas - 08] <x> += <y>Ā costs more gas thanĀ <x> = <x> + <y>

Using the addition operator instead of plus-equals saves gas.

Instances of this issue :

[Gas - 09] SplittingĀ if()Ā statements that useĀ ||/&&Ā saves gas

Whenever the conditional statement uses the ||/&& operator to revert the same error, itā€˜s better to split the if statement so that the first condition is executed directly rather than having both conditions executed.

Instances of this issue :

[Gas - 10] Internal functions called once can be inlined to save gas

When internal functions are called once in the contract, it is better to inline them rather than declaring because function declarations are expensive.

Instances of this issue :

  • ERC1967Upgrade.sol L68

[Gas - 11] Use IsZero EVM opcode for Zero address / Zero value checks

Since there is a direct opcode for this operation, implementing this saves gas.

Instances of this issue :

[Gas - 12] Empty block should be removed or emit something

The code should be refactored such that they no longer exist, or the block should do something useful, such as emitting an event or reverting. If the contract is meant to be extended, the contract should beĀ abstract and the function signatures are added without any default implementation. If the block is an empty if-statement block to avoid doing subsequent checks in the else-if/else conditions, the else-if/else conditions should be nested under the negation of the if-statement, because they involve different classes of checks, which may lead to the introduction of errors when the code is later modified (if(x){}else if(y){...}else{...} => Ā if(!x){if(y){...}else{...}})

Instances of this issue :

#0 - GalloDaSballo

2022-09-26T20:48:24Z

Around 600 gas 500 of which from moving memory to calldata

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax Ā© 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter