Axelar Network v2 contest - djxploit's results

Missing 0 address check in constructor :

https://github.com/code-423n4/2022-07-axelar/blob/main/xc20/contracts/XC20Wrapper.sol#L27 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/AxelarDepositService.sol#L18

Dependence on block.timestamp, they can be manipulated

https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/AxelarGateway.sol#L157 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/AxelarGateway.sol#L615

Dependence on block.chainId , they can be manipulated

https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/AxelarGateway.sol#L286

Use safetransfer instead of transfer

https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/gas-service/AxelarGasService.sol#L128 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/gas-service/AxelarGasService.sol#L144 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/ReceiverImplementation.sol#L86 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/ReceiverImplementation.sol#L71 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/ReceiverImplementation.sol#L51 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/ReceiverImplementation.sol#L23 https://github.com/code-423n4/2022-07-axelar/blob/main/xc20/contracts/XC20Wrapper.sol#L63

For loop gas optimizations :

In line https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/auth/AxelarAuthWeighted.sol#L69, the for loop can be optimized as :

for (uint256 i ; i < weightsLength;) {
            totalWeight += newWeights[i];
            unchecked {
                ++i;
            }
        }

• removing unnecessary initialization
• Using unchecked , as it will not overflow , because there is a check going on.

Such for loop optimizations can be found at below line also : https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/auth/AxelarAuthWeighted.sol#L98 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/AxelarGateway.sol#L207 Also in line : https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/auth/AxelarAuthWeighted.sol#L116 accounts.length - 1 should be pre-calculated, so that the calculation doesn't happen at every loop the for loop runs.

Also in line https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/AxelarDepositService.sol#L114, https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/AxelarDepositService.sol#L168, https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/AxelarDepositService.sol#L204, https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/gas-service/AxelarGasService.sol#L123, the for loop can be optimized by using ++i instead of i++ and also using unchecked.

Unnecessary initialization to default value:

In line https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/auth/AxelarAuthWeighted.sol#L68 uint256 totalWeight = 0; is not required, because totalWeight's default value is 0. Such other optimizations can be found at : https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/auth/AxelarAuthWeighted.sol#L94 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/auth/AxelarAuthWeighted.sol#L95

If-else optimizations

In line https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/auth/AxelarAuthWeighted.sol#L76, epochForHash[newOperatorsHash] will always be greater or equal to 0, as it's an uint, so the if statement can be simplified to as : if (epochForHash[newOperatorsHash]) revert SameOperators();

Similarly in line : https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/AxelarDepositService.sol#L165 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/gas-service/AxelarGasService.sol#L128 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/gas-service/AxelarGasService.sol#L131 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/AxelarGateway.sol#L255 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/AxelarGateway.sol#L613 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/AxelarGateway.sol#L228 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/ReceiverImplementation.sol#L23 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/ReceiverImplementation.sol#L51 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/ReceiverImplementation.sol#L71

<= or >= is cheaper than > or < , so use them if possible:

https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/auth/AxelarAuthWeighted.sol#L72 https://github.com/code-423n4/2022-07-axelar/blob/main/contracts/deposit-service/DepositBase.sol#L32 https://github.com/code-423n4/2022-07-axelar/blob/main/xc20/contracts/XC20Wrapper.sol#L85