ElasticSwap contest - bobi's results

Handle

bobi

Vulnerability details

Impact

When dealing with unsigned integer types, comparisons with != 0 are a cheaper operation than with > 0; since uint is >= 0 by nature, this change will not alter the program's behavior.

Proof of Concept

Such comparisons are found in:

MathLib.sol

MathLib.sol::125 => require(_tokenAQty > 0, "MathLib: INSUFFICIENT_QTY");
MathLib.sol::127 => _tokenAReserveQty > 0 && _tokenBReserveQty > 0,
MathLib.sol::266 => baseTokenQtyDecayChange > 0,
MathLib.sol::336 => quoteTokenQtyDecayChange > 0,
MathLib.sol::347 => require(quoteTokenDecay > 0, "MathLib: NO_QUOTE_DECAY");
MathLib.sol::388 => if (_totalSupplyOfLiquidityTokens > 0) {
MathLib.sol::496 => _baseTokenQtyDesired > 0,
MathLib.soll::500 => _quoteTokenQtyDesired > 0,
MathLib.sol::606 => _baseTokenReserveQty > 0 &&
MathLib.sol::607 => _internalBalances.baseTokenReserveQty > 0,
MathLib.sol::664 => _baseTokenQty > 0 && _quoteTokenQtyMin > 0,

Exchange.sol

Exchange.sol::113 => if (tokenQtys.liquidityTokenFeeQty > 0) {
Exchange.sol::178 => require(this.totalSupply() > 0, "Exchange: INSUFFICIENT_LIQUIDITY");
Exchange.sol::180 => _baseTokenQtyMin > 0 && _quoteTokenQtyMin > 0,
Exchange.sol::238 => if (liquidityTokenFeeQty > 0) {
Exchange.sol::277 => _baseTokenQty > 0 && _minQuoteTokenQty > 0,
Exchange.sol::314 => _quoteTokenQty > 0 && _minBaseTokenQty > 0,

Recommended Mitigation Steps

change the comparison statement with != 0; for eg:

From: MathLib.sol::125 => require(_tokenAQty > 0, "MathLib: INSUFFICIENT_QTY");

To: MathLib.sol::125 => require(_tokenAQty != 0, "MathLib: INSUFFICIENT_QTY");