Yield Witch v2 contest - ajtra's results

Fixed-rate borrowing and lending on Ethereum

General Information

Platform: Code4rena

Start Date: 14/07/2022

Pot Size: $25,000 USDC

Total HM: 2

Participants: 63

Period: 3 days

Judge: PierrickGT

Total Solo HM: 1

Id: 147

League: ETH

Yield

Findings Distribution

Researcher Performance

Rank: 56/63

Findings: 1

Award: $16.89

🌟 Selected for report: 0

🚀 Solo Findings: 0

  1. Operatos <= or >= cost more gas than operators < or >. Change all <= / >= operators for < / > and remember to increse / decrese in consecuence to maintain the logic (example, a <= b for a < b + 1) Witch.sol line 102 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L102 require(initialOffer <= 1e18, "InitialOffer above 100%"); Witch.sol line 103 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L103 require(proportion <= 1e18, "Proportion above 100%"); Witch.sol line 105 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L105 initialOffer == 0 || initialOffer >= 0.01e18 Witch.sol line 108 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L108 require(proportion >= 0.01e18, "Proportion below 1%"); Witch.sol line 200 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L200 require(limits_.sum <= limits_.max, "Collateral limit reached"); Witch.sol line 256 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L256 require(cauldron.level(vaultId) >= 0, "Undercollateralized"); Witch.sol line 313 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L313 require(liquidatorCut >= minInkOut, "Not enough bought"); Witch.sol line 365 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L365 require(liquidatorCut >= minInkOut, "Not enough bought"); Witch.sol line 438 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L438 auction_.art - artIn >= debt.min * (10**debt.dec)

  2. != 0 is cheaper than >0. Replace all > 0 for != 0 Witch.sol line 255 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L255 require(auction_.start > 0, "Vault not under auction"); Witch.sol line 300 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L300 require(auction_.start > 0, "Vault not under auction"); Witch.sol line 358 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L358 require(auction_.start > 0, "Vault not under auction"); Witch.sol line 393 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L393 if (liquidatorCut > 0) Witch.sol line 398 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L398 if (auctioneerCut > 0) Witch.sol line 416 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L416 require(auction_.start > 0, "Vault not under auction");

  3. Variable1 = Variable1 + (-) Variable2 is cheaper in gas cost than variable1 += (-=) variable2.. Witch.sol line 204 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L204 limits_.sum += Witch.sol line 259 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L259 -= auction_.ink; Witch.sol line 430 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L430 -= auction_.ink; Witch.sol line 443 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L443 -= inkOut.u128(); Witch.sol line 444 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L444 -= artIn.u128(); Witch.sol line 450 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L450 -= inkOut.u128(); Witch.sol line 598 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L598 -= auctioneerCut;

  4. In require statements with 2 or more conditions (with || or &&) it's important to set the more probably codition (or less cost) in the first place. This is important because of many times there is not mandatory to evaluate the second conditions. in the following sentence condition initialOffer >= 0.01e18 is more likely to be met than condition initialOffer == 0. Witch.sol line 105 https://github.com/code-423n4/2022-07-yield/blob/6ab092b8c10e4dabb470918ae15c6451c861655f/contracts/Witch.sol#L105 initialOffer == 0 || initialOffer >= 0.01e18,

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter