Kuiper contest - chasemartin01's results

Handle

chasemartin01

Vulnerability details

Impact

Functions that are called externally and not used in the contracts should be declared as external.

Proof of Concept

There's several public functions that can be declared external

changePublisher(address) should be declared external:
	- Basket.changePublisher(address) (contracts/Basket.sol#133-148)
changeLicenseFee(uint256) should be declared external:
	- Basket.changeLicenseFee(uint256) (contracts/Basket.sol#152-166)
publishNewIndex(address[],uint256[]) should be declared external:
	- Basket.publishNewIndex(address[],uint256[]) (contracts/Basket.sol#170-194)
deleteNewIndex() should be declared external:
	- Basket.deleteNewIndex() (contracts/Basket.sol#207-214)
setMinLicenseFee(uint256) should be declared external:
	- Factory.setMinLicenseFee(uint256) (contracts/Factory.sol#39-41)
setAuctionDecrement(uint256) should be declared external:
	- Factory.setAuctionDecrement(uint256) (contracts/Factory.sol#43-45)
setAuctionMultiplier(uint256) should be declared external:
	- Factory.setAuctionMultiplier(uint256) (contracts/Factory.sol#47-49)
setBondPercentDiv(uint256) should be declared external:
	- Factory.setBondPercentDiv(uint256) (contracts/Factory.sol#51-53)
setOwnerSplit(uint256) should be declared external:
	- Factory.setOwnerSplit(uint256) (contracts/Factory.sol#55-59)
proposeBasketLicense(uint256,string,string,address[],uint256[]) should be declared external:
	- Factory.proposeBasketLicense(uint256,string,string,address[],uint256[]) (contracts/Factory.sol#65-91)

Tools Used

Slither

Recommended Mitigation Steps

Change instances of functions that are public and can be external to external

Handle

chasemartin01

Vulnerability details

Impact

Gas optimisation

Example

As an example, you can change the declaration of inputTokens, inputWeights, outputTokens, outputWeights to be calldata as a gas optimisation

https://github.com/code-423n4/2021-09-defiProtocol/blob/main/contracts/contracts/Auction.sol#L69-L75

There's other instances of this in Basket.sol andFactory.sol

Explanation

When you specify memory for a function param for an external function, the following happens: the compiler copies elements from calldata to memory (using the opcode calldatacopy.) Note that there is also the opcode calldataload to read an offset from calldata. By changing the location from memory to calldata, you avoid this expensive copy from calldata to memory, while managing to do exactly what's needed.

Tools Used

Manual analysis

Recommended Mitigation Steps

Change all instances of memory to calldata where the function parameter isn't being modified