Axelar Network v2 contest - Waze's results

Decentralized interoperability network.

General Information

Platform: Code4rena

Start Date: 29/07/2022

Pot Size: $50,000 USDC

Total HM: 6

Participants: 75

Period: 5 days

Judge: GalloDaSballo

Total Solo HM: 3

Id: 149

League: ETH

Axelar Network

Findings Distribution

Researcher Performance

Rank: 34/75

Findings: 2

Award: $88.02

🌟 Selected for report: 0

🚀 Solo Findings: 0

#1 Missing indexed field refundAddress

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/interfaces/IAxelarGasService.sol#L20

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/interfaces/IAxelarGasService.sol#L32

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/interfaces/IAxelarGasService.sol#L41

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/interfaces/IAxelarGasService.sol#L52

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/interfaces/IAxelarGasService.sol#L55

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/interfaces/IAxelarGasService.sol#L57

Each event should use three indexed fields if there are three or more fields. add indexed in refundAddress.

#2 Missing contract check before low level call

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L222-L231

Low-level calls return success if there is no code present at the specified address. In addition to the zero-address checks, add a check to verify that <address>.code.length > 0

#3 Missing check for address when assign values to state variable of address

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/xc20/contracts/XC20Wrapper.sol#L26

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/AxelarDepositService.sol#L18

add simple check for address to ensure address not 0.

#4 Missing check TokenAddress cant be zero

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/DepositBase.sol#L65

to transfer some token the receiver address must be exist. add simple check for receiver address to ensure address not 0.

#5 Multiple mappings can be combined into a single mapping an address to struct

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/xc20/contracts/XC20Wrapper.sol#L20-L21

make the address mapping to a struct

#6 use recently pragma solidity

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/DepositBase.sol#L3

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L3

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/gas-service/AxelarGasService.sol#L3

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/AxelarDepositService.sol#L3

Use a solidity version of at least 0.8.12 to get string.concat() to be used instead of abi.encodePacked(<str>,<str>)

#0 - GalloDaSballo

2022-09-04T21:03:36Z

https://github.com/code-423n4/2022-07-axelar-findings/issues/1 Missing indexed field refundAddress

NC

Missing contract check before low level call

L

Missing check for address when assign values to state variable of address & Missing check TokenAddress cant be zero

L

Multiple mappings can be combined into a single mapping an address to struct

Disputed as lists are separate

use recently pragma solidity

NC

2L 2NC

#1 Cache the authModule.code.length and tokenDeployerImplementation.code.length

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L49-L50

cache the authModule.code.length and tokenDeployerImplementation.code.length to the memory can reduce the gas fee. because mload is cheaper than sload.

#2 Cache limits.length

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L205

cache the limits.length to the memory can reduce the gas fee. because mload is cheaper than sload.

#3 cache symbols.length

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L205-L207

cache the symbols.length because it use multiple times. read the mload are cheaper than sload

#4 Looping

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L205-L209

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/gas-service/AxelarGasService.sol#L123

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/AxelarDepositService.sol#L115

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/AxelarDepositService.sol#L204

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/auth/AxelarAuthWeighted.sol#L17

default uint is 0 so remove unnecassary explicit can reduce gas. caching the array length can reduce gas it caused access to a local variable is more cheap than query storage / calldata / memory in solidity. pre increment e.g ++i more cheaper gas than post increment e.g i++. i suggest to use pre increment.

#5 Cache setupParams.length

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L228

cache the setupParams.length to the memory can reduce the gas fee. because mload is cheaper than sload.

#6 Use calldata instead memory

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/auth/AxelarAuthWeighted.sol#L55

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/AxelarDepositService.sol#L220

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L447

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L271-L273

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L277-L279

In the external functions where the function argument is read-only, the function() has an inputed parameter that using memory, if this function didnt change the parameter, its cheaper to use calldata then memory. so we suggest to change it

#7 Cache commands.length and params.length

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/AxelarGateway.sol#L290

cache the commands.length and params.length to the memory can reduce the gas fee. because mload is cheaper than sload.

#8 Use storage instead memory

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/DepositBase.sol#L30

Use storage instead of memory to reduce the gas fee. i suggest to change this.

#9 Cache symbolBytes.length

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/deposit-service/DepositBase.sol#L32

cache the symbolBytes.length to the memory can reduce the gas fee. because mload is cheaper than sload.

#10 inefficient code Epoch

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/auth/AxelarAuthWeighted.sol#L78-L79

inefficient in coding epoch just change this to saving more gas

uint256 epoch = currentEpoch + 1; currentEpoch = epoch;

to

uint256 currentEpoch += 1;

#11 Default uint

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/contracts/auth/AxelarAuthWeighted.sol#L94-L95

the default value of uint is 0, so remove unnecassary explicit code initializations for default values e.g uint i = 0; to uint i;.

#12 Caching LocalAsset(xc20Token)

https://github.com/code-423n4/2022-07-axelar/blob/9c4c44b94cddbd48b9baae30051a4e13cbe39539/xc20/contracts/XC20Wrapper.sol#L61-L62

cache the LocalAsset(xc20Token) because it use multiple times. read the mload are cheaper than sload

#0 - GalloDaSballo

2022-08-25T01:42:12Z

Cache the authModule.code.length and tokenDeployerImplementation.code.length

This has got to be a bot submission, the length is the length of the code

300 for the loops, rest is honestly just wrong

#1 - GalloDaSballo

2022-08-25T01:42:23Z

Will penalize this submission down to 100 gas

#2 - GalloDaSballo

2022-08-25T01:43:00Z

<img width="759" alt="Screenshot 2022-08-25 at 03 42 36" src="https://user-images.githubusercontent.com/13383782/186555048-3530cce7-0b76-48be-a786-39f83b729e39.png"> Like maybe you actually wrote this one, however it's wrong as the variable is actually from memory and doesn't save an SLOAD
AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter