Platform: Code4rena
Start Date: 29/07/2022
Pot Size: $50,000 USDC
Total HM: 6
Participants: 75
Period: 5 days
Judge: GalloDaSballo
Total Solo HM: 3
Id: 149
League: ETH
Rank: 43/75
Findings: 2
Award: $87.36
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: oyc_109
Also found by: 0x1f8b, 0x52, 0xNazgul, 0xSmartContract, 0xf15ers, 8olidity, Aymen0909, Bnke0x0, CertoraInc, Chom, CodingNameKiki, Deivitto, Dravee, ElKu, IllIllI, JC, Lambda, Noah3o6, NoamYakov, RedOneN, Respx, ReyAdmirado, Rohan16, Rolezn, Ruhum, Sm4rty, TomJ, Twpony, Waze, Yiko, __141345__, ajtra, apostle0x01, ashiq0x01, asutorufos, bardamu, benbaessler, berndartmueller, bharg4v, bulej93, c3phas, cccz, ch13fd357r0y3r, codexploder, cryptonue, cryptphi, defsec, djxploit, durianSausage, fatherOfBlocks, gogo, hansfriese, horsefacts, ignacio, kyteg, lucacez, mics, rbserver, robee, sashik_eth, simon135, sseefried, tofunmi, xiaoming90
56.1237 USDC - $56.12
N-1 public
functions not called by the contract should be declared external instead
Contracts are allowed to override their parents' functions and change the visibility from external to public.
XC20Wrapper.sol L#40
DepositBase.sol L#41
N-2 Incorrect Comment AxelarGAteway.sol L#29
#0 - GalloDaSballo
2022-08-28T20:40:45Z
Disputed <img width="615" alt="Screenshot 2022-08-28 at 22 40 11" src="https://user-images.githubusercontent.com/13383782/187093644-bfa20783-a41d-46c9-9193-68fe288dda1a.png">
NC
🌟 Selected for report: IllIllI
Also found by: 0x1f8b, 0xNazgul, 0xsam, 8olidity, Aymen0909, Bnke0x0, Chom, CodingNameKiki, Deivitto, Dravee, ElKu, Fitraldys, JC, Lambda, MiloTruck, Noah3o6, NoamYakov, RedOneN, Respx, ReyAdmirado, Rohan16, Rolezn, Ruhum, Sm4rty, TomJ, Tomio, Waze, __141345__, a12jmx, ajtra, ak1, apostle0x01, asutorufos, benbaessler, bharg4v, bulej93, c3phas, defsec, djxploit, durianSausage, erictee, fatherOfBlocks, gerdusx, gogo, kyteg, lucacez, medikko, mics, owenthurm, oyc_109, rbserver, robee, sashik_eth, simon135, tofunmi
31.2355 USDC - $31.24
G-1 ++I
COSTS LESS GAS THAN I++
, ESPECIALLY WHEN IT’S USED IN FOR-LOOPS (--I
/I--
TOO)
Saves 6 gas per loop
AxelarGateway.sol L#207
AxelarAuthWeighted.sol L#98 AxelarAuthWeighted.sol L#116
G-2 <ARRAY>.LENGTH SHOULD NOT BE LOOKED UP IN EVERY LOOP OF A FOR-LOOP The overheads outlined below are PER LOOP, excluding the first loop
storage arrays incur a Gwarmaccess (100 gas) memory arrays use MLOAD (3 gas) calldata arrays use CALLDATALOAD (3 gas) Caching the length changes each of these to a DUP<N> (3 gas), and gets rid of the extra DUP<N> needed to store the stack offset
AxelarAuthWeighted.sol L#98 AxelarAuthWeighted.sol L#116
G-3 ++I
/I++
SHOULD BE UNCHECKED{++I
}/UNCHECKED{I++}
WHEN IT IS NOT POSSIBLE FOR THEM TO OVERFLOW, AS IS THE CASE WHEN USED IN FOR
- AND WHILE
-LOOPS
AxelarGateway.sol L#207
AxelarAuthWeighted.sol L#98 AxelarAuthWeighted.sol L#116
G-4 MULTIPLE ADDRESS
MAPPINGS CAN BE COMBINED INTO A SINGLE MAPPING
OF AN ADDRESS
TO A STRUCT, WHERE APPROPRIATE
Saves a storage slot for the mapping. Depending on the circumstances and sizes of types, can avoid a Gsset (20000 gas) per mapping combined. Reads and subsequent writes can also be cheaper when a function requires both values and they both fit in the same storage slot. Finally, if both fields are accessed in the same function, can save ~42 gas per access due to not having to recalculate the key’s keccak256 hash (Gkeccak256 - 30 gas) and that calculation’s associated stack operations.
G-5 IT COSTS MORE GAS TO INITIALIZE VARIABLES TO ZERO THAN TO LET THE DEFAULT OF ZERO BE APPLIED AxelarGateway.sol L#207 AxelarAuthWeighted.sol L#68 AxelarAuthWeighted.sol L#94-95 AxelarAuthWeighted.sol L#98 AxelarAuthWeighted.sol L#116
#0 - GalloDaSballo
2022-08-20T18:59:11Z
40 gas from keccak + less than 100 for rest
#1 - GalloDaSballo
2022-08-20T18:59:18Z
150 to be generous