Axelar Network v2 contest - asutorufos's results

Decentralized interoperability network.

General Information

Platform: Code4rena

Start Date: 29/07/2022

Pot Size: $50,000 USDC

Total HM: 6

Participants: 75

Period: 5 days

Judge: GalloDaSballo

Total Solo HM: 3

Id: 149

League: ETH

Axelar Network

Findings Distribution

Researcher Performance

Rank: 43/75

Findings: 2

Award: $87.36

🌟 Selected for report: 0

🚀 Solo Findings: 0

N-1 public functions not called by the contract should be declared external instead Contracts are allowed to override their parents' functions and change the visibility from external to public. XC20Wrapper.sol L#40 DepositBase.sol L#41

N-2 Incorrect Comment AxelarGAteway.sol L#29

#0 - GalloDaSballo

2022-08-28T20:40:45Z

N-1 public functions not called by the contract should be declared external instead

Disputed <img width="615" alt="Screenshot 2022-08-28 at 22 40 11" src="https://user-images.githubusercontent.com/13383782/187093644-bfa20783-a41d-46c9-9193-68fe288dda1a.png">

N-2 Incorrect Comment

NC

G-1 ++I COSTS LESS GAS THAN I++, ESPECIALLY WHEN IT’S USED IN FOR-LOOPS (--I/I-- TOO) Saves 6 gas per loop AxelarGateway.sol L#207

AxelarAuthWeighted.sol L#98 AxelarAuthWeighted.sol L#116

G-2 <ARRAY>.LENGTH SHOULD NOT BE LOOKED UP IN EVERY LOOP OF A FOR-LOOP The overheads outlined below are PER LOOP, excluding the first loop

storage arrays incur a Gwarmaccess (100 gas) memory arrays use MLOAD (3 gas) calldata arrays use CALLDATALOAD (3 gas) Caching the length changes each of these to a DUP<N> (3 gas), and gets rid of the extra DUP<N> needed to store the stack offset

AxelarGateway.sol L#207

AxelarAuthWeighted.sol L#98 AxelarAuthWeighted.sol L#116

G-3 ++I/I++ SHOULD BE UNCHECKED{++I}/UNCHECKED{I++} WHEN IT IS NOT POSSIBLE FOR THEM TO OVERFLOW, AS IS THE CASE WHEN USED IN FOR- AND WHILE-LOOPS AxelarGateway.sol L#207

AxelarAuthWeighted.sol L#98 AxelarAuthWeighted.sol L#116

G-4 MULTIPLE ADDRESS MAPPINGS CAN BE COMBINED INTO A SINGLE MAPPING OF AN ADDRESS TO A STRUCT, WHERE APPROPRIATE Saves a storage slot for the mapping. Depending on the circumstances and sizes of types, can avoid a Gsset (20000 gas) per mapping combined. Reads and subsequent writes can also be cheaper when a function requires both values and they both fit in the same storage slot. Finally, if both fields are accessed in the same function, can save ~42 gas per access due to not having to recalculate the key’s keccak256 hash (Gkeccak256 - 30 gas) and that calculation’s associated stack operations.

https://github.com/code-423n4/2022-07-axelar/blob/main/xc20/contracts/XC20Wrapper.sol#:~:text=mapping(address,)%20public%20unwrapped%3B

G-5 IT COSTS MORE GAS TO INITIALIZE VARIABLES TO ZERO THAN TO LET THE DEFAULT OF ZERO BE APPLIED AxelarGateway.sol L#207 AxelarAuthWeighted.sol L#68 AxelarAuthWeighted.sol L#94-95 AxelarAuthWeighted.sol L#98 AxelarAuthWeighted.sol L#116

#0 - GalloDaSballo

2022-08-20T18:59:11Z

40 gas from keccak + less than 100 for rest

#1 - GalloDaSballo

2022-08-20T18:59:18Z

150 to be generous

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter