Fraxlend (Frax Finance) contest - cRat1st0s's results

2022-08-frax-code4rena Report

• 2022-08-frax-code4rena Report
  • Files Description Table
  • QA Report
  • Issues found
    • [N-01]: Typos
      • Impact
      • Code Affected and Mitigation
      • Tools used

Files Description Table

QA Report

Issues found

[N-01]: Typos

Impact

None.

Code Affected and Mitigation

diff --git a/src/contracts/FraxlendPair.sol b/src/contracts/FraxlendPair.sol
index d54b8f5..be5f345 100644
--- a/src/contracts/FraxlendPair.sol
+++ b/src/contracts/FraxlendPair.sol
@@ -184,7 +184,7 @@ contract FraxlendPair is FraxlendPairCore {
         return totalBorrow.toShares(_amount, _roundUp);
     }
 
-    /// @notice The ```toBorrtoBorrowAmountowShares``` function converts a given amount of borrow debt into the number of shares
+    /// @notice The ```toBorrowAmount``` function converts a given amount of borrow debt into the number of shares
     /// @param _shares Shares of borrow
     /// @param _roundUp Whether to roundup during division
     function toBorrowAmount(uint256 _shares, bool _roundUp) external view returns (uint256) {
@@ -283,8 +283,8 @@ contract FraxlendPair is FraxlendPairCore {
 
     /// @notice The ```setApprovedLenders``` function sets a given set of addresses to the whitelist
     /// @dev Cannot black list self
-    /// @param _lenders The addresses whos status will be set
-    /// @param _approval The approcal status
+    /// @param _lenders The addresses whose status will be set
+    /// @param _approval The approval status
     function setApprovedLenders(address[] calldata _lenders, bool _approval) external approvedLender(msg.sender) {
         for (uint256 i = 0; i < _lenders.length; i++) {
             // Do not set when _approval == false and _lender == msg.sender
@@ -302,8 +302,8 @@ contract FraxlendPair is FraxlendPairCore {
 
     /// @notice The ```setApprovedBorrowers``` function sets a given array of addresses to the whitelist
     /// @dev Cannot black list self
-    /// @param _borrowers The addresses whos status will be set
-    /// @param _approval The approcal status
+    /// @param _borrowers The addresses whose status will be set
+    /// @param _approval The approval status
     function setApprovedBorrowers(address[] calldata _borrowers, bool _approval) external approvedBorrower {
         for (uint256 i = 0; i < _borrowers.length; i++) {
             // Do not set when _approval == false and _borrower == msg.sender
diff --git a/src/contracts/FraxlendPairCore.sol b/src/contracts/FraxlendPairCore.sol
index a712d46..794cc36 100644
--- a/src/contracts/FraxlendPairCore.sol
+++ b/src/contracts/FraxlendPairCore.sol
@@ -228,7 +228,7 @@ abstract contract FraxlendPairCore is FraxlendPairConstants, IERC4626, ERC20, Ow
         // Set approved borrowers whitelist
         borrowerWhitelistActive = _isBorrowerWhitelistActive;
 
-        // Set approved lenders whitlist active
+        // Set approved lenders whitelist active
         lenderWhitelistActive = _isLenderWhitelistActive;
 
         // Set maturity date & penalty interest rate
@@ -890,10 +890,10 @@ abstract contract FraxlendPairCore is FraxlendPairConstants, IERC4626, ERC20, Ow
     // Functions: Liquidations
     // ============================================================================================
     /// @notice The ```Liquidate``` event is emitted when a liquidation occurs
-    /// @param _borrower The borrower account for which the liquidation occured
+    /// @param _borrower The borrower account for which the liquidation occurred
     /// @param _collateralForLiquidator The amount of Collateral Token transferred to the liquidator
     /// @param _sharesToLiquidate The number of Borrow Shares the liquidator repaid on behalf of the borrower
-    /// @param _sharesToAdjust The number of Borrow Shares that were adjusted on liabilites and assets (a writeoff)
+    /// @param _sharesToAdjust The number of Borrow Shares that were adjusted on liabilities and assets (a writeoff)
     event Liquidate(
         address indexed _borrower,
         uint256 _collateralForLiquidator,
diff --git a/src/contracts/FraxlendPairDeployer.sol b/src/contracts/FraxlendPairDeployer.sol
index f8d959e..590475b 100644
--- a/src/contracts/FraxlendPairDeployer.sol
+++ b/src/contracts/FraxlendPairDeployer.sol
@@ -165,7 +165,7 @@ contract FraxlendPairDeployer is Ownable {
     // ============================================================================================
 
     /// @notice The ```setCreationCode``` function sets the bytecode for the fraxlendPair
-    /// @dev splits the data if necessary to accomodate creation code that is slightly larger than 24kb
+    /// @dev splits the data if necessary to accommodate creation code that is slightly larger than 24kb
     /// @param _creationCode The creationCode for the Fraxlend Pair
     function setCreationCode(bytes calldata _creationCode) external onlyOwner {
         bytes memory _firstHalf = BytesLib.slice(_creationCode, 0, 13000);
diff --git a/src/contracts/FraxlendWhitelist.sol b/src/contracts/FraxlendWhitelist.sol
index da34880..79e099b 100644
--- a/src/contracts/FraxlendWhitelist.sol
+++ b/src/contracts/FraxlendWhitelist.sol
@@ -44,7 +44,7 @@ contract FraxlendWhitelist is Ownable {
     /// @param _bool approval being set
     event SetOracleWhitelist(address indexed _address, bool _bool);
 
-    /// @notice The ```setOracleContractWhitelist``` function sets a given address to true/false for use as oralce
+    /// @notice The ```setOracleContractWhitelist``` function sets a given address to true/false for use as oracle
     /// @param _addresses addresses to set status for
     /// @param _bool status of approval
     function setOracleContractWhitelist(address[] calldata _addresses, bool _bool) external onlyOwner {
diff --git a/src/contracts/VariableInterestRate.sol b/src/contracts/VariableInterestRate.sol
index cf9dde8..e41e1e0 100644
--- a/src/contracts/VariableInterestRate.sol
+++ b/src/contracts/VariableInterestRate.sol
@@ -29,7 +29,7 @@ import "./interfaces/IRateCalculator.sol";
 
 /// @title A formula for calculating interest rates as a function of utilization and time
 /// @author Drake Evans github.com/drakeevans
-/// @notice A Contract for calulcating interest rates as a function of utilization and time
+/// @notice A Contract for calculating interest rates as a function of utilization and time
 contract VariableInterestRate is IRateCalculator {
     // Utilization Rate Settings
     uint32 private constant MIN_UTIL = 75000; // 75%

Tools used

VS Code

2022-08-frax-code4rena Report

• 2022-08-frax-code4rena Report
  • Files Description Table
  • Gas Optimizations
    • [G-01]: For-Loops: Pre-increments cost less gas compared to post-increments
      • Impact
      • Code Affected:
      • Mitigation
      • Tools used
    • [G-02]: For-Loops: Increments can be unchecked
      • Impact
      • Code Affected:
      • Mitigation
      • Tools used
    • [G-03]: For-Loops: No need to explicitly initialize variables with default values
      • Impact
      • Code Affected:
      • Mitigation
      • Tools used
    • [G-04]: Use Custom Errors
      • Impact
      • Mitigation
      • Tools used

Files Description Table

Gas Optimizations

[G-01]: For-Loops: Pre-increments cost less gas compared to post-increments

Impact

Pre-increments cost less gas compared to post-increments.

Code Affected:

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPair.sol#L289

for (uint256 i = 0; i < _lenders.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPair.sol#L308

for (uint256 i = 0; i < _borrowers.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairDeployer.sol#L130

i++;

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairDeployer.sol#L158

i++;

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendWhitelist.sol#L51

for (uint256 i = 0; i < _addresses.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendWhitelist.sol#L66

for (uint256 i = 0; i < _addresses.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendWhitelist.sol#L81

for (uint256 i = 0; i < _addresses.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/libraries/SafeERC20.sol#L27

for (i = 0; i < 32 && data[i] != 0; i++) {

Mitigation

Change i++ to ++i.

Tools used

VS Code

[G-02]: For-Loops: Increments can be unchecked

Impact

In Solidity 0.8+, there’s a default overflow check on unsigned integers.

Code Affected:

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPair.sol#L289

for (uint256 i = 0; i < _lenders.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPair.sol#L308

for (uint256 i = 0; i < _borrowers.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L265

for (uint256 i = 0; i < _approvedBorrowers.length; ++i) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L270

for (uint256 i = 0; i < _approvedLenders.length; ++i) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendWhitelist.sol#L51

for (uint256 i = 0; i < _addresses.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendWhitelist.sol#L66

for (uint256 i = 0; i < _addresses.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendWhitelist.sol#L81

for (uint256 i = 0; i < _addresses.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/libraries/SafeERC20.sol#L27

for (i = 0; i < 32 && data[i] != 0; i++) {

Mitigation

One example is the code would go from:

        for (uint256 i = 0; i < _lenders.length; i++) {
            // Do not set when _approval == false and _lender == msg.sender
            if (_approval || _lenders[i] != msg.sender) {
                approvedLenders[_lenders[i]] = _approval;
                emit SetApprovedLender(_lenders[i], _approval);
            }
        }

to:

        for (uint256 i = 0; i < _lenders.length; ) {
            // Do not set when _approval == false and _lender == msg.sender
            if (_approval || _lenders[i] != msg.sender) {
                approvedLenders[_lenders[i]] = _approval;
                emit SetApprovedLender(_lenders[i], _approval);
            }
            unchecked {
                i++;
            }
        }

Tools used

VS Code

[G-03]: For-Loops: No need to explicitly initialize variables with default values

Impact

If a variable is not set/initialized, it is assumed to have the default value (0, false, 0x0, etc depending on the data type). If you explicitly initialize it with its default value, you are just wasting gas.

Code Affected:

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPair.sol#L289

for (uint256 i = 0; i < _lenders.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPair.sol#L308

for (uint256 i = 0; i < _borrowers.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L265

for (uint256 i = 0; i < _approvedBorrowers.length; ++i) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairCore.sol#L270

for (uint256 i = 0; i < _approvedLenders.length; ++i) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairDeployer.sol#L127

for (i = 0; i < _lengthOfArray; ) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairDeployer.sol#L152

for (i = 0; i < _lengthOfArray; ) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendPairDeployer.sol#L402

for (uint256 i = 0; i < _lengthOfArray; ) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendWhitelist.sol#L51

for (uint256 i = 0; i < _addresses.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendWhitelist.sol#L66

for (uint256 i = 0; i < _addresses.length; i++) {

https://github.com/code-423n4/2022-08-frax/blob/c4189a3a98b38c8c962c5ea72f1a322fbc2ae45f/src/contracts/FraxlendWhitelist.sol#L81

for (uint256 i = 0; i < _addresses.length; i++) {

Mitigation

Do not initialize variables with default values.

Tools used

VS Code

[G-04]: Use Custom Errors

Impact

Less expensive and able to use dynamic information in them.

Mitigation

Use custom errors.

Tools used

VS Code