Float Capital contest - bw's results

Handle

bw

Vulnerability details

Impact

The YieldManagerAave.sol contract made use of a number of public variables that were set only in the constructor and would remain constant. These variables were consuming storage slots, which unnecessarily increased the deployment and runtime gas costs of the contract.

For more information regarding the immutable keyword: https://blog.soliditylang.org/2020/05/13/immutable-keyword/

Proof of Concept

Code Diff

diff --git a/contracts/contracts/YieldManagerAave.sol b/contracts/contracts/YieldManagerAave.sol
index c7e23b2..042930f 100644
--- a/contracts/contracts/YieldManagerAave.sol
+++ b/contracts/contracts/YieldManagerAave.sol
@@ -22,20 +22,20 @@ contract YieldManagerAave is IYieldManager {
     ╚═════════════════════════════╝*/
 
   /// @notice address of longShort contract
-  address public longShort;
+  address public immutable longShort;
   /// @notice address of treasury contract - this is the address that can claim aave incentives rewards
-  address public treasury;
+  address public immutable treasury;
 
   /// @notice The payment token the yield manager supports
   /// @dev DAI token
-  ERC20 public paymentToken;
+  ERC20 public immutable paymentToken;
   /// @notice The token representing the interest accruing payment token position from Aave
   /// @dev ADAI token
-  IERC20Upgradeable public aToken;
+  IERC20Upgradeable public immutable aToken;
   /// @notice The specific Aave lending pool contract
-  ILendingPool public lendingPool;
+  ILendingPool public immutable lendingPool;
   /// @notice The specific Aave incentives controller contract
-  IAaveIncentivesController public aaveIncentivesController;
+  IAaveIncentivesController public immutable aaveIncentivesController;
 
   /// @dev An aave specific referralCode that has been a depricated feature. This will be set to 0 for "no referral" at deployment
   uint16 referralCode;
@@ -97,7 +97,7 @@ contract YieldManagerAave is IYieldManager {
     aaveIncentivesController = IAaveIncentivesController(_aaveIncentivesController);
 
     // Approve tokens for aave lending pool maximally.
-    paymentToken.approve(address(lendingPool), type(uint256).max);
+    ERC20(_paymentToken).approve(_lendingPool, type(uint256).max);
   }

By removing the public keyword from all variables that are not required (which are only used in the unit tests), the deployment costs can be further reduced.

Tools Used

https://www.npmjs.com/package/hardhat-gas-reporter

Recommended Mitigation Steps

Add the immutable key word to all variables that are only set during the constructor.