Caviar contest - cryptonue's results

A fully on-chain NFT AMM that allows you to trade every NFT in a collection.

General Information

Platform: Code4rena

Start Date: 12/12/2022

Pot Size: $36,500 USDC

Total HM: 8

Participants: 103

Period: 7 days

Judge: berndartmueller

Id: 193

League: ETH

Caviar

Findings Distribution

Researcher Performance

Rank: 74/103

Findings: 1

Award: $14.83

Gas:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

14.833 USDC - $14.83

Labels

bug
G (Gas Optimization)
grade-b
G-24

External Links

[G-01] Remove Owned inheritance contract and replace with immutable owner

Originally:

src/Caviar.sol:Caviar contract
Deployment CostDeployment Size
462524723078
Function Nameminavgmedianmax# calls
create913339539934137053472634190
destroy251156196351635110
owner34816812348234812
pairs7971511797279714
src/LpToken.sol:LpToken contract
Deployment CostDeployment Size
8067695039
Function Nameminavgmedianmax# calls
balanceOf608971608260811
burn304711047126471264712
mint2488145751467814678189
name11931193119311931
symbol12361236123612361
totalSupply363193223632363130

After removing Owned inheritance (and replace with immutable owner) in Caviar.sol and LpToken.sol

Example implementation for LpToken, (the Caviar would be similar approach, but no need the onlyOwner modifier)

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.17;

import "solmate/tokens/ERC20.sol";

contract LpToken is ERC20 {
    address immutable owner;

    modifier onlyOwner {
        require(msg.sender == owner, "Not Owner");
        _;
    }

    constructor(string memory pairSymbol)
        ERC20(string.concat(pairSymbol, " LP token"), string.concat("LP-", pairSymbol), 18)
    {
        owner = msg.sender;
    }

    function mint(address to, uint256 amount) public onlyOwner{
        _mint(to, amount);
    }

    function burn(address from, uint256 amount) public onlyOwner{
        _burn(from, amount);
    }
}
src/Caviar.sol:Caviar contract
Deployment CostDeployment Size
451347722588
Function Nameminavgmedianmax# calls
create926332940033473563406285190
destroy248855956328632810
owner20420420420412
pairs8191533819281914
src/LpToken.sol:LpToken contract
Deployment CostDeployment Size
7404964783
Function Nameminavgmedianmax# calls
balanceOf542905542254211
burn28809046104801048012
mint2480343808447034470389
name11931193119311931
symbol12361236123612361
totalSupply363193223632363130

Gas Snapshots difference from foundry test before and after

testItRemovesPairFromMapping(address,address,bytes32,address) (gas: 30 (0.016%)) testItRemovesPairFromMapping() (gas: -7 (-0.047%)) testItEmitsDestroyEvent() (gas: -29 (-0.186%)) testItMintsLpTokensAfterInit() (gas: -1778 (-0.208%)) testItMintsLpTokensAfterInit(uint256,uint256) (gas: -1778 (-0.220%)) testItAddsBuysSellsRemovesCorrectAmount(uint256,uint256,uint256) (gas: -1800 (-0.229%)) testOnlyPairCanRemoveItself() (gas: -32 (-0.292%)) testItMintsLpTokensAfterInit() (gas: -1777 (-0.324%)) testItRevertsSlippageAfterInitMint() (gas: -1662 (-0.356%)) testItInitMintsLpTokensToSender(uint256,uint256) (gas: -1715 (-0.452%)) testItMintsLpTokensAfterInitWithEther() (gas: -1778 (-0.556%)) testItTransfersNfts() (gas: -2078 (-0.776%)) testItTransfersBaseTokens() (gas: -2078 (-0.788%)) testItInitMintsLpTokensToSender() (gas: -2144 (-0.818%)) testItTransfersBaseTokens() (gas: -2167 (-1.283%)) testItTransfersNfts() (gas: -2167 (-1.285%)) testItReturnsBaseTokenAmountAndFractionalTokenAmount() (gas: -2167 (-1.332%)) testItBurnsLpTokens() (gas: -2299 (-1.365%)) testItSellsWithMerkleProof() (gas: -66427 (-1.452%)) testItAddsWithMerkleProof() (gas: -66427 (-1.521%)) testItRevertsSlippageAfterInitMint() (gas: -2078 (-1.552%)) testItAddsWithMerkleProof() (gas: -66349 (-1.558%)) testItTransfersBaseTokens() (gas: -2078 (-1.646%)) testItEmitsAddEvent() (gas: -2078 (-1.658%)) testItTransfersFractionalTokens() (gas: -2078 (-1.671%)) testItInitMintsLpTokensToSender() (gas: -2144 (-1.716%)) testItSetsSymbolsAndNames() (gas: -66349 (-1.901%)) testItSavesPair(address,address,bytes32) (gas: -66327 (-1.906%)) testItRevertsIfDeployingSamePairTwice() (gas: -66335 (-1.935%)) testItEmitsCreateEvent() (gas: -66348 (-1.935%)) testItSavesPair() (gas: -66326 (-1.937%)) testItReturnsPair() (gas: -66348 (-1.938%)) testItTransfersEther() (gas: -2078 (-2.118%)) testItTransfersBaseTokens() (gas: -2167 (-2.124%)) testItTransfersFractionalTokens() (gas: -2167 (-2.164%)) testItEmitsRemoveEvent() (gas: -2167 (-2.169%)) testItBurnsLpTokens() (gas: -2299 (-2.261%)) testItReturnsBaseTokenAmountAndFractionalTokenAmount() (gas: -2167 (-2.265%)) testItEmitsWithdrawEvent() (gas: -1853 (-2.497%)) testItTransfersNftsAfterWithdraw() (gas: -1854 (-2.506%)) testItTransfersEther() (gas: -2167 (-3.099%)) testItReturnsBaseTokenAmountAndFractionalTokenAmount(uint256) (gas: -2167 (-4.247%)) testItEmitsCloseEvent() (gas: -2173 (-5.218%)) testCannotWithdrawIfNotAdmin() (gas: -2317 (-5.445%)) testCannotWithdrawIfNotEnoughTimeElapsed() (gas: -2317 (-5.457%)) testExitSetsCloseTimestamp() (gas: -2173 (-5.610%)) testCannotExitIfNotAdmin() (gas: -2144 (-12.581%)) testCannotWithdrawIfNotClosed() (gas: -2144 (-13.471%)) Overall gas change: -669472 (-108.059%)

In short gas for deployment diff:

  • Caviar diff 23078 - 22588 = 490

  • LpToken diff 5039 - 4783 = 256

#0 - c4-judge

2023-01-14T17:14:43Z

berndartmueller marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter