Ondo Finance contest - eyexploit's results

Finding 1 : check borrower == liquidator before getting KYC status to save the gas

https://github.com/code-423n4/2023-01-ondo/blob/f3426e5b6b4561e09460b2e6471eb694efdd6c70/contracts/lending/tokens/cCash/CTokenCash.sol#L1013

Above check is performed before checking the KYC status for both borrower and liquidator. Here KYC status is fetching through an external call to the KYC registry contract which cost high amount of gas and if borrower and liquidator are the same then there is unnecessary wastage of gas.

We might think vice versa, where borrower and liquidator are different, but unauthorize. But again it just perform equal to check, which is much cheaper than the external call in above case.

Recommendation : Make sure above check execute before the https://github.com/code-423n4/2023-01-ondo/blob/f3426e5b6b4561e09460b2e6471eb694efdd6c70/contracts/lending/tokens/cCash/CTokenCash.sol#L997-L998

Finding 2 : transferTokens checking twice for KYC status for the same user

Tokens which are getting transferred via transfer function have same spender and src, which means in the transferTokens function it will check the KYC status twice for the same address. Its make an external call to the registry contract to get the KYC status for passed address, and doing it twice waste the gas.

File: contracts/lending/tokens/cCash/CTokenCash.sol

  function transferTokens(
    address spender,
    address src,
    address dst,
    uint tokens
  ) internal returns (uint) {
    /* Revert if KYC not valid */
    require(_getKYCStatus(spender), "Spender not KYC'd");
    require(_getKYCStatus(src), "Source not KYC'd");
    ...
}

File: contracts/lending/tokens/cCash/CTokenCash.sol

  function transfer(
    address dst,
    uint256 amount
  ) external override nonReentrant returns (bool) {
    return transferTokens(msg.sender, msg.sender, dst, amount) == NO_ERROR;
  }

Recommendation consider modifiy transferTokens function to below

  function transferTokens(
    address spender,
    address src,
    address dst,
    uint tokens
  ) internal returns (uint) {
    /* Revert if KYC not valid */
    if(spender != src) {
       require(_getKYCStatus(spender), "Spender not KYC'd");
       require(_getKYCStatus(src), "Source not KYC'd");
    } 
    require(_getKYCStatus(spender), "Spender not KYC'd");
    require(_getKYCStatus(dst), "Destination not KYC'd");
   ...
}