Canto v2 contest - fatherOfBlocks's results

Execution layer for original work.

General Information

Platform: Code4rena

Start Date: 28/06/2022

Pot Size: $25,000 USDC

Total HM: 14

Participants: 50

Period: 4 days

Judge: GalloDaSballo

Total Solo HM: 7

Id: 141

League: ETH

Canto

Findings Distribution

Researcher Performance

Rank: 23/50

Findings: 2

Award: $70.56

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

46.6054 USDC - $46.61

Labels

bug
QA (Quality Assurance)

External Links

Accountant/AccountantDelegate.sol

  • L7 - The import of hardhat/console.sol is found, therefore the code does not compile.

Accountant/AccountantDelegator.sol

  • L22 - The require does not show any message when reverting, it would be preferable to show a message so that the user understands the reason for the rejection.

Governance/Comp.sun

  • L63 - In solidity 0.8 the constructor does not need visibility, in this case the constructor is set: public.

  • L86/115/128 - In the approve() function, instead of having to validate that the input uint256 rawAmount enters uint96, a uint96 could be directly requested as input.

Governance/GovernorAlpha.sol

  • L130 - In solidity 0.8 the constructor does not need visibility, in this case the constructor is set: public.

  • L204 - This declaration shadows an existing declaration. It is not defined whether data is being retrieved from storage or memory.

Governance/GovernorBravoDelegator.sol

  • L80 - This contract has a payable fallback function, but no receive ether function. Consider adding a receive ether function.

  • L7 - In solidity 0.8 the constructor does not need visibility, in this case the constructor is set: public.

Treasury/TreasuryDelegator.sol

  • L12 - In the constructor they are used in one way, but in the constructor it is put exactly the other way around, it should be: admin_, implementation_, note_.

Note.sol

  • L22/23 - The require does not show any message when reversing, it would be preferable to show a message so that the user understands the reason for the rejection.

  • L13/17 - The name of the _mint_to_Accountant() function uses snake case and camel case at the same time, something that is not respected in all functions, the same format should be followed for all functions. The RetAccountant() function starts with a capital letter, which is not normal in development.

ERC20.sol

  • L29 - In solidity 0.8 the constructor does not need visibility, in this case the constructor is set: public.

  • L65 - The decimals function should be pure.

CNote.sol

  • L5/6 - TreasuryInterfaces and ErrorReporter are imported and are not used in any part of the code, therefore it is an unnecessary waste of gas in the deploy.

  • L74/121 - The require does not show any message when reversing, it would be preferable to show a message so that the user understands the reason for the rejection.

CErc20.sol

  • L5 - The import of hardhat/console.sol is found, therefore the code does not compile.

CToken.sol

  • L69 - The transferTokens() function does not respect the check effect interact pattern. The if of line 77 could be validated first, then everything that happens in line 82 below and finally the transferAllowed of line 71 to 74.

  • L401 - In the mintFresh() function there is a lot of commented code, this should be removed or used.

Reservoir.sol

  • L33 - In solidity 0.8 the constructor does not need visibility, in this case the constructor is set: public.

manifest/ProposalStore.sol

  • L44 - The require does not show any message when reverting, it would be preferable to show a message so that the user understands the reason for the rejection.

manifest/ERC20Burnable.sol

  • L35 - The only difference between the ERC20Burneable from open zeppelin and the one created is the if that validates allowance != type(uint).max In addition, no contract is used, only the OpenZeppelin contract is used in the ERC20MinterBurnerDecimals.sol contract

#0 - GalloDaSballo

2022-08-13T22:32:42Z

L7 - The import of hardhat/console.sol is found, therefore the code does not compile.

Code compiles just fine

The require does not show any message when reverting,

NC

L63 - In solidity 0.8 the constructor does not need visibility,

NC

L86/115/128 - In the approve() function,

Disputed as it would break the ERC20 implementation

#1 - GalloDaSballo

2022-08-14T20:10:21Z

L204 - This declaration shadows an existing declaration

Disagree as one is a variable, the other a function

L80 - This contract has a payable fallback function

Disputed as Delegate has a way to transfer

L12 - In the constructor they are used in one way

NC

L22/23 - The require does not show any message when reversing,

NC

L13/17 - The name of the _mint_to_Accountant()

NC

L65 - The decimals function should be pure.

R

L5/6 - TreasuryInterfaces and ErrorReporter

It will not cost extra gas (Compiler removes the code), valid Refactoring nonetheless

L5 - The import of hardhat/console.sol

Valid NC

L69 - The transferTokens() function does not respect the check effect interact pattern.

There's an external call initially, however it's done to a known destination, for this reason, in lack of additional details (my judging being longer than the report's comment), will not consider

L401 - In the mintFresh()

Only 1 line is commented, disputed

#2 - GalloDaSballo

2022-08-14T20:10:46Z

2R 6NC

Awards

23.9548 USDC - $23.95

Labels

bug
G (Gas Optimization)

External Links

Accountant/AccountantDelegate.sol

  • L28 - It is not necessary to create an array with an address, you could directly use an address, this is unnecessary.

  • L35/36/98/99 - It is not necessary to create a variable in memory if it is only going to be used once in the function.

  • L87/101 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.

  • L87/101 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.

ExponentialNoError.sol

  • L38/39/46/47 - It is not necessary to create a variable in memory if it is only going to be used once in the function.

Accountant/AccountantDelegator.sol

  • L22/42/43/123 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.

  • L42/43/123 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.

  • L54/55/63/64 - It is not necessary to create a variable in memory if it is only going to be used once in the function.

Governance/Comp.sun

  • L134/166/167/168/190/234/235/237/238/263 - The revert messages in the require have more than 32 bytes, it could save gas if instead of such long strings smaller strings were used or equal to 32 bytes.

  • L167 - Instead of variable++ it is less expensive to make ++variable.

  • L179/245/248/255/265 - Instead of variable > 0 it is less expensive to make variable != 0

  • L179/198/199/208/217/248/255/265/266/269 - Instead of variable - 1 or + 1 it is less expensive to make variable --/++variable.

  • L207 - It is not necessary to create a variable and set it to its default value, this generates less gas cost.

  • L190/234/235/276/281/287/292 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.

  • L224/225/228/230 - It is not necessary to create a variable in memory if it is only going to be used once in the function.

  • L293 - If an operation was previously validated, it can become unchecked so that gas is not spent validating the underflow/overflow.

Governance/GovernorAlpha.sol

  • L137/138/139/140/145/146/156/178/189/194/205/208/228/258/263/266/283/288/293/298/304/309 - The require could generate a lower gas cost, if instead of require an if with a custom error is used.

  • L137/138/139/145/146/156/178/189/194/205/228/258/263/266/283/288/293/298 - The revert messages in the require have more than 32 bytes, Gas could be saved if instead of such long strings, strings less than or equal to 32 bytes were used.

  • L181/197/211 - Instead of i++, unchecked{++i;} could be used, this is because it is not possible to reach type(uint).max

  • L181/197/211 - Gas could be saved in the for loop by creating a variable in memory for proposal.targets.length.

  • L181/197/211 - It is not necessary to create a variable in memory if it is only going to be used once in the function.

  • L228 - Instead of variable > 0 it is less expensive to make variable != 0

  • L310 - If an operation was previously validated, it can become unchecked so that gas is not spent validating the underflow/overflow.

  • L266 - Instead of validating variable == false, it is less expensive to validate: !variable

  • L138/139/140 - As targets.length is used so many times, a variable could be generated in memory, in this way less gas would be spent.

Governance/GovernorBravoDelegate.sol

  • L25/26/27/42/46/47/53/76/85/128/129/140/158/176/181 - The require could generate a lower gas cost, if instead of require an if was used with a custom error.

  • L25/27/45/76/85/129/140/158 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings .

  • L42/43/44/46/47 - As targets.length is used so many times, a variable could be generated in memory, in this way less gas would be used.

  • L66/88 - Instead of i++, unchecked{++i;} could be used, this is because it is not possible to reach type(uint).max

  • L66/88 - You could save gas in the for loop if you create a variable in memory for proposal.targets.length or newProposal.

  • L66/88 - It is not necessary to create a variable in memory if it is only going to be used once in the function.

Governance/GovernorBravoDelegator.sol

  • L27/28/40/48/56 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.

  • L27/28/40/48/56 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.

Treasury/TreasuryDelegate.sol

  • L34/35/43/44 - It is not necessary to create a variable in memory if it will only be used once in the function.

Treasury/TreasuryDelegator.sol

  • L13/31/32/121 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.

  • L31/32/121 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.

  • L45/46/54/55 - It is not necessary to create a variable in memory if it is only going to be used once in the function.

Note.sol

  • L24/27 - It would be less expensive to do admin = accountant_; that admin = accountant; since it would be consulting a variable in memory instead of a variable in storage.

CNote.sol

  • L17/74/94/105/121/147/148/157 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.

  • L17 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.

  • L34/35/57/58/60 - It is not necessary to create a variable in memory if it is only going to be used once in the function.

CErc20.sol

  • L129/130/186/220/229 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.

  • L129/130/229 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.

CToken.sol

  • L37/493 - Instead of variable > 0 it is less expensive to make variable != 0

  • L37/485/765 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.

  • L33/34/37/42/50/349/485/765/768/774/912/1114/1154 - The require could generate a lower gas cost, if instead of require an if with a custom error was used .

  • L82/177/178/955/958 - It is not necessary to create a variable in memory if it is only going to be used once in the function.

  • L352/534/535/6682/683/823/1064 - If an operation was previously validated, it can become unchecked so that gas is not spent validating the underflow/overflow.

  • L724 - In the liquidateBorrowFresh() function, it has an order of verifications that could be optimized, if all those validations that are only inputs are validated first, it could generate less gas costs. It could also be checked which validations are less expensive and run them earlier.

  • L879 - It is validated that msg.sender == address(0), something that is impossible since there are no private keys for that address.

Reservoir.sol

  • L38 - It is not necessary to set a variable with its default value, since this value already has it and in any case it generates an extra gas expense.

manifest/ProposalStore.sol

  • L38/39/45/46 - It is not necessary to create a variable in memory if it will only be used once in the function.

manifest/ERC20MinterBurnerDecimals.sol

  • L72/86/100/114 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.

  • L72/86/100/114 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.

#0 - GalloDaSballo

2022-08-14T20:46:43Z

No immutables so less than 300 gas saved

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter