Platform: Code4rena
Start Date: 28/06/2022
Pot Size: $25,000 USDC
Total HM: 14
Participants: 50
Period: 4 days
Judge: GalloDaSballo
Total Solo HM: 7
Id: 141
League: ETH
Rank: 23/50
Findings: 2
Award: $70.56
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: zzzitron
Also found by: 0v3rf10w, 0x1f8b, 0x29A, AlleyCat, Bnke0x0, Chom, Funen, JC, Lambda, Limbooo, Meera, Picodes, Sm4rty, TerrierLover, TomJ, __141345__, asutorufos, aysha, c3phas, cccz, defsec, fatherOfBlocks, grGred, hake, ignacio, ladboy233, mrpathfindr, oyc_109, rfa, sach1r0, samruna, slywaters, ynnad
46.6054 USDC - $46.61
Accountant/AccountantDelegate.sol
Accountant/AccountantDelegator.sol
Governance/Comp.sun
L63 - In solidity 0.8 the constructor does not need visibility, in this case the constructor is set: public.
L86/115/128 - In the approve() function, instead of having to validate that the input uint256 rawAmount enters uint96, a uint96 could be directly requested as input.
Governance/GovernorAlpha.sol
L130 - In solidity 0.8 the constructor does not need visibility, in this case the constructor is set: public.
L204 - This declaration shadows an existing declaration. It is not defined whether data is being retrieved from storage or memory.
Governance/GovernorBravoDelegator.sol
L80 - This contract has a payable fallback function, but no receive ether function. Consider adding a receive ether function.
L7 - In solidity 0.8 the constructor does not need visibility, in this case the constructor is set: public.
Treasury/TreasuryDelegator.sol
Note.sol
L22/23 - The require does not show any message when reversing, it would be preferable to show a message so that the user understands the reason for the rejection.
L13/17 - The name of the _mint_to_Accountant() function uses snake case and camel case at the same time, something that is not respected in all functions, the same format should be followed for all functions. The RetAccountant() function starts with a capital letter, which is not normal in development.
ERC20.sol
L29 - In solidity 0.8 the constructor does not need visibility, in this case the constructor is set: public.
L65 - The decimals function should be pure.
CNote.sol
L5/6 - TreasuryInterfaces and ErrorReporter are imported and are not used in any part of the code, therefore it is an unnecessary waste of gas in the deploy.
L74/121 - The require does not show any message when reversing, it would be preferable to show a message so that the user understands the reason for the rejection.
CErc20.sol
CToken.sol
L69 - The transferTokens() function does not respect the check effect interact pattern. The if of line 77 could be validated first, then everything that happens in line 82 below and finally the transferAllowed of line 71 to 74.
L401 - In the mintFresh() function there is a lot of commented code, this should be removed or used.
Reservoir.sol
manifest/ProposalStore.sol
manifest/ERC20Burnable.sol
#0 - GalloDaSballo
2022-08-13T22:32:42Z
Code compiles just fine
NC
NC
Disputed as it would break the ERC20 implementation
#1 - GalloDaSballo
2022-08-14T20:10:21Z
Disagree as one is a variable, the other a function
Disputed as Delegate has a way to transfer
NC
NC
NC
R
It will not cost extra gas (Compiler removes the code), valid Refactoring nonetheless
Valid NC
There's an external call initially, however it's done to a known destination, for this reason, in lack of additional details (my judging being longer than the report's comment), will not consider
Only 1 line is commented, disputed
#2 - GalloDaSballo
2022-08-14T20:10:46Z
2R 6NC
🌟 Selected for report: 0x1f8b
Also found by: 0x29A, 0xArshia, 0xKitsune, Bnke0x0, Chom, Fitraldys, Funen, JC, Lambda, Meera, Noah3o6, Picodes, RedOneN, Rohan16, Sm4rty, TerrierLover, TomJ, Tomio, Waze, ajtra, c3phas, cRat1st0s, defsec, durianSausage, fatherOfBlocks, grGred, hake, ladboy233, m_Rassska, mrpathfindr, oyc_109, rfa, ynnad
23.9548 USDC - $23.95
Accountant/AccountantDelegate.sol
L28 - It is not necessary to create an array with an address, you could directly use an address, this is unnecessary.
L35/36/98/99 - It is not necessary to create a variable in memory if it is only going to be used once in the function.
L87/101 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.
L87/101 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.
ExponentialNoError.sol
Accountant/AccountantDelegator.sol
L22/42/43/123 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.
L42/43/123 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.
L54/55/63/64 - It is not necessary to create a variable in memory if it is only going to be used once in the function.
Governance/Comp.sun
L134/166/167/168/190/234/235/237/238/263 - The revert messages in the require have more than 32 bytes, it could save gas if instead of such long strings smaller strings were used or equal to 32 bytes.
L167 - Instead of variable++ it is less expensive to make ++variable.
L179/245/248/255/265 - Instead of variable > 0 it is less expensive to make variable != 0
L179/198/199/208/217/248/255/265/266/269 - Instead of variable - 1 or + 1 it is less expensive to make variable --/++variable.
L207 - It is not necessary to create a variable and set it to its default value, this generates less gas cost.
L190/234/235/276/281/287/292 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.
L224/225/228/230 - It is not necessary to create a variable in memory if it is only going to be used once in the function.
L293 - If an operation was previously validated, it can become unchecked so that gas is not spent validating the underflow/overflow.
Governance/GovernorAlpha.sol
L137/138/139/140/145/146/156/178/189/194/205/208/228/258/263/266/283/288/293/298/304/309 - The require could generate a lower gas cost, if instead of require an if with a custom error is used.
L137/138/139/145/146/156/178/189/194/205/228/258/263/266/283/288/293/298 - The revert messages in the require have more than 32 bytes, Gas could be saved if instead of such long strings, strings less than or equal to 32 bytes were used.
L181/197/211 - Instead of i++, unchecked{++i;} could be used, this is because it is not possible to reach type(uint).max
L181/197/211 - Gas could be saved in the for loop by creating a variable in memory for proposal.targets.length.
L181/197/211 - It is not necessary to create a variable in memory if it is only going to be used once in the function.
L228 - Instead of variable > 0 it is less expensive to make variable != 0
L310 - If an operation was previously validated, it can become unchecked so that gas is not spent validating the underflow/overflow.
L266 - Instead of validating variable == false, it is less expensive to validate: !variable
L138/139/140 - As targets.length is used so many times, a variable could be generated in memory, in this way less gas would be spent.
Governance/GovernorBravoDelegate.sol
L25/26/27/42/46/47/53/76/85/128/129/140/158/176/181 - The require could generate a lower gas cost, if instead of require an if was used with a custom error.
L25/27/45/76/85/129/140/158 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings .
L42/43/44/46/47 - As targets.length is used so many times, a variable could be generated in memory, in this way less gas would be used.
L66/88 - Instead of i++, unchecked{++i;} could be used, this is because it is not possible to reach type(uint).max
L66/88 - You could save gas in the for loop if you create a variable in memory for proposal.targets.length or newProposal.
L66/88 - It is not necessary to create a variable in memory if it is only going to be used once in the function.
Governance/GovernorBravoDelegator.sol
L27/28/40/48/56 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.
L27/28/40/48/56 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.
Treasury/TreasuryDelegate.sol
Treasury/TreasuryDelegator.sol
L13/31/32/121 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.
L31/32/121 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.
L45/46/54/55 - It is not necessary to create a variable in memory if it is only going to be used once in the function.
Note.sol
CNote.sol
L17/74/94/105/121/147/148/157 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.
L17 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.
L34/35/57/58/60 - It is not necessary to create a variable in memory if it is only going to be used once in the function.
CErc20.sol
L129/130/186/220/229 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.
L129/130/229 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.
CToken.sol
L37/493 - Instead of variable > 0 it is less expensive to make variable != 0
L37/485/765 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.
L33/34/37/42/50/349/485/765/768/774/912/1114/1154 - The require could generate a lower gas cost, if instead of require an if with a custom error was used .
L82/177/178/955/958 - It is not necessary to create a variable in memory if it is only going to be used once in the function.
L352/534/535/6682/683/823/1064 - If an operation was previously validated, it can become unchecked so that gas is not spent validating the underflow/overflow.
L724 - In the liquidateBorrowFresh() function, it has an order of verifications that could be optimized, if all those validations that are only inputs are validated first, it could generate less gas costs. It could also be checked which validations are less expensive and run them earlier.
L879 - It is validated that msg.sender == address(0), something that is impossible since there are no private keys for that address.
Reservoir.sol
manifest/ProposalStore.sol
manifest/ERC20MinterBurnerDecimals.sol
L72/86/100/114 - The revert messages in the require have more than 32 bytes, gas could be saved if strings less than or equal to 32 bytes were used instead of such long strings.
L72/86/100/114 - The require could generate a lower gas cost, if instead of require an if with a custom error was used.
#0 - GalloDaSballo
2022-08-14T20:46:43Z
No immutables so less than 300 gas saved