Holograph contest - chrisdior4's results

Missing events 

Events are missing despite that the function is changing the state and it is best practice this to be registrated via an event emitting.

File: HolographGenesis.sol

1. function deploy( uint256 chainId, bytes12 saltHash, bytes memory sourceCode, bytes memory initCode ) external onlyDeployer { require(chainId == block.chainid, "HOLOGRAPH: incorrect chain id"); bytes32 salt = bytes32(abi.encodePacked(msg.sender, saltHash)); address contractAddress = address( uint160(uint256(keccak256(abi.encodePacked(bytes1(0xff), address(this), salt, keccak256(sourceCode))))) ); require(!_isContract(contractAddress), "HOLOGRAPH: already deployed"); assembly { contractAddress := create2(0, add(sourceCode, 0x20), mload(sourceCode), salt) } require(_isContract(contractAddress), "HOLOGRAPH: deployment failed"); require( InitializableInterface(contractAddress).init(initCode) == InitializableInterface.init.selector, "HOLOGRAPH: initialization failed" );

1.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographGenesis.sol#L124

========================================

2.function approveDeployer(address newDeployer, bool approve) external onlyDeployer { _approvedDeployers[newDeployer] = approve; } 2.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographGenesis.sol#L146

Code Style: constants should be named in all caps

Here are some examples that the code style does not follow the best practices:

File: HolographBridge.sol

1.bytes32 constant _factorySlot = 0xa49f20855ba576e09d13c8041c8039fa655356ea27f6c40f1ec46a4301cd5b23; 1.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographBridge.sol#L126

1.Consider changing the name to: FACTORY_SLOT

File: HolographTreasury.sol

2.bytes32 constant _holographSlot = 0xb4107f746e9496e8452accc7de63d1c5e14c19f510932daa04077cd49e8bd77a; 2.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographTreasury.sol#L133

2.Consider changing the name to: HOLOGRAPH_SLOT

Conditions should be inclusive

Conditions should be >= or <= instead of only < or >, otherwise, these functions will fail.

File: HolographBridge.sol

1.if (gasPrice < type(uint256).max && gasLimit < type(uint256).max) { 1.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographBridge.sol#L381

Consider changing it to:

1.if (gasPrice <= type(uint256).max && gasLimit <= type(uint256).max) {

<x>+= <y> COSTS MORE GAS THAN  <x>= <x>+ <y> FOR STATE VARIABLES</y></x></x></y></x>

Using the addition operator instead of plus-equals saves 113 gas

File: HolographFactory.sol

1.v += 27; 1.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographFactory.sol#L328

Showing how the change should be done for every other instances from this finding

The change would be:

1.v = v + 27;

File: HolographOperator.sol

2._bondedAmounts[job.operator] -= amount; 2.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographOperator.sol#L378

3.position -= threshold; 3.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographOperator.sol#L1175

4._bondedAmounts[msg.sender] += amount; 4.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographOperator.sol#L382

5._bondedAmounts[operator] += amount; 5.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographOperator.sol#L834

6.current += (current / _operatorThresholdDivisor) * (position / _operatorThresholdStep); 6.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographOperator.sol#L1177

INCREMENTS/DECREMENTS CAN BE UNCHECKED IN FOR-LOOPS

In Solidity 0.8+, there’s a default overflow check on unsigned integers. It’s possible to uncheck this in for-loops and save some gas at each iteration, but at the cost of some code readability, as this uncheck cannot be made inline.

Consider wrapping with an unchecked block here (around 25 gas saved per instance):

File: HolographInterfaces.sol

1.for (uint256 i = 0; i < uriTypes.length; i++) { 1.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographInterfaces.sol#L235

Showing how the change should be done for every other instances from this finding

The change would be:

• for (uint256 i; i < uriTypes.length) { // ...
• unchecked { ++i; }

2.for (uint256 i = 0; i < length; i++) { 2.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographInterfaces.sol#L264

3.for (uint256 i = 0; i < interfaceIds.length; i++) { 3.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographInterfaces.sol#L286

File: HolographOperator.sol

4.for (uint256 i = 0; i < length; i++) { 4.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographOperator.sol#L781

5.for (uint256 i = _operatorPods.length; i <= pod; i++) { 5.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographOperator.sol#L871

File: HolographRegistry.sol

6.for (uint256 i = 0; i < reservedTypes.length; i++) { 6.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographRegistry.sol#L175

7.for (uint256 i = 0; i < length; i++) { 7.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographRegistry.sol#L255

8.for (uint256 i = 0; i < hashes.length; i++) { 8.https://github.com/code-423n4/2022-10-holograph/blob/f8c2eae866280a1acfdc8a8352401ed031be1373/contracts/HolographRegistry.sol#L322