PoolTogether contest - adriro's results

A no-loss prize-savings protocol.

General Information

Platform: Code4rena

Start Date: 01/12/2022

Pot Size: $26,900 USDC

Total HM: 3

Participants: 19

Period: 4 days

Judge: GalloDaSballo

Id: 188

League: ETH

PoolTogether

Findings Distribution

Researcher Performance

Rank: 17/19

Findings: 1

Award: $53.42

Gas:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Findings Information

🌟 Selected for report: Tricko

Also found by: 0x4non, AkshaySrivastav, Madalad, Rolezn, adriro, cryptonue, neko_nyaa

Labels

bug
G (Gas Optimization)
grade-b
G-08

Awards

53.4153 USDC - $53.42

External Links

Split require that use && into multiple statements

https://github.com/pooltogether/ERC5164/blob/5647bd84f2a6d1a37f41394874d567e45a97bf48/src/ethereum-optimism/EthereumToOptimismExecutor.sol#L80-L84

This require checks that caller is the bridge and that the original messages comes from the relayer on the other side of the chain. Consider splitting the require into two separate statements to save gas.

See this issue which describes the fact that there is a larger deployment gas cost, but with enough runtime calls, the change ends up being cheaper by 3 gas.

Consider using immutable variables for relayer and executor in Arbitrum and Optimism contracts

In both chains, the relayer needs a reference to the executor and the executor needs a reference the relayer. This is implemented using a setter (which is intented to be used only once) and a storage variable to hold the address.

Since in both cases the address is only set once and can't be modified, consider using an immutable variable which will save an sload in each side of the bridge for each bridged message.

The dependency loop at construction time (relayer needs executor and executor needs relayer) can be solved by using precomputed addresses and deploying the contracts using a factory along with create2.

#0 - GalloDaSballo

2022-12-26T21:20:21Z

I believe immutables can be achieved by setting up:

  • Determinsitic Deployment Factory (See work by z0age)
  • Pre-compute and input those during setup (you'll know the deployment address before deploying them)

I will award 2.1k / 2 because of the extra work (and will apply it consistently to all other reports for fairness)

1050

#1 - c4-judge

2022-12-26T23:13:34Z

GalloDaSballo marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter