Connext Amarok contest - fatherOfBlocks's results

The interoperability protocol of L2 Ethereum.

General Information

Platform: Code4rena

Start Date: 08/06/2022

Pot Size: $115,000 USDC

Total HM: 26

Participants: 72

Period: 11 days

Judge: leastwood

Total Solo HM: 14

Id: 132

League: ETH

Connext

Findings Distribution

Researcher Performance

Rank: 46/72

Findings: 2

Award: $226.51

🌟 Selected for report: 0

🚀 Solo Findings: 0

BaseConnextFacet.sol

  • L10 - AppStorage variable s has a very undeclarative name.

  • L13/14/36 - The function modifier nonReentrant() can be implemented spending less gas by using a bool.

  • L36/55/63/71/79/87 - Modifier functions can be replaced by private view functions or use ifs with custom errors.

  • L124/125 - A local variable is created that is only used once, so it could be used directly in the split.

DiamondLoupeFacet.sol

  • L16 - There is commented code that is not used.

  • L57/188 - It should be checked in the setAavePool() function that the new address complies with the IAavePool() interface, otherwise it would generate a DoS in _backLoan().

RelayerFacet.sol

  • L144/168 - Instead of i++ you can save gas with ++i;

RoutersFacet.sol

  • L6 - AppStorage is imported and never used.

DiamondInit.sol

  • L60/63/65 - There is commented code that is not used.

StableSwap.sol

  • L112/113 - There is commented code that is not used.

PromiseRouter.sol

  • L11 - The IBridgeToken import is not used in the contract.

AmplificationUtils.sol

  • L4 - The SafeERC20 import is not used in the contract.

  • L52 - In the _getAPprecise() function it is not validated that t1.sub(t0) is 0, since it is used to divide, in lines 61/64.

AssetLogic.sol

  • L4 - The import of IWrapped and ITokenRegistry are not used in the contract.

LibConnextStorage.sol

  • There is a lot of documentation that is commented, this should be removed or used.

SwapUtils.sol

  • L161 - It should be validated that self.tokenPrecisionMultipliers[tokenIndex] is != 0, otherwise it would be dividing by zero and would revert without a message.

  • L207/208/209 - There is commented code, it should be removed or uncommented.

  • L211 - It should be validated that v.d0 is != 0, otherwise it would be dividing by zero and it would revert without a message.

  • L218 - It should be validated that self.tokenPrecisionMultipliers[tokenIndex] is != 0, otherwise it would be dividing by zero and would revert without a message.

  • L590/602/604 - It should be validated that d0 is != 0, and revert, since it will not be able to execute the returns, if one reverts before, it could save executing the for of line 591.

DiamondLoupeFacet.sol

  • L31 - Gas is saved if instead of i++, ++i is used with unchecked.

BridgeFacet.sol

  • L68 - It is not necessary to set variables with the default value.

  • L293/499/665 - Less gas cost is generated if variable != 0 is used instead of variable > 0

  • L332 - Instead of s.nonce += 1; gas can be saved by using ++s.nonce;

  • L613/684/799 - Instead of i++ you can save gas with ++i;

RelayerFacet.sol

  • L144/168 - Instead of i++ you can save gas with ++i;

RoutersFacet.sol

  • L540/543/544/583 - It is better to perform the validations as soon as possible, without making extra calls, spending less gas if it reverses.

StableSwapFacet.sol

  • L415- Gas is saved, if instead of uint i = 0; uint i is used; Also, gas is saved if instead of i++, unchecked{++i;} is used

  • L416- Less gas cost is generated if variable != 0 is used instead of variable > 0

VersionFacet.sol

  • L16 - It is not necessary to set variables with the default value.

DiamondInit.sol

  • L70 - It is not necessary to set variables with the default value.

ConnextPriceOracle.sol

  • L176 - Gas is saved, if instead of uint i = 0; uint i is used; Also, gas is saved if instead of i++, unchecked{++i;} is used

  • L150- Less gas cost is generated if variable != 0 is used instead of variable > 0.

  • L109/111/118/119 - It is not necessary to create a variable that will only be used once, it could be returned directly.

  • L71 - You can save gas, instead of using requires and modifiers, you can use private view functions or custom errors with ifs.

Executor.sol

  • L56 - You can save gas, instead of using requires and modifiers, you can use private view functions or custom errors with ifs.

  • L79/80/90/91- It is not necessary to create a variable that will only be used once, it could be returned directly.

LPToken.sol

  • L35/50 - You can save gas, instead of using requires you can use private view functions or custom errors with ifs.

ProposedOwnableUpgradeable.sol

  • L130/138 - Gas can be saved, instead of using modifiers, private view functions can be used to avoid gas costs.

SponsorVault.sol

  • L120 - Gas can be saved, instead of using modifiers, private view functions can be used to avoid gas costs.

  • L217 - Less gas cost is generated if variable != 0 is used instead of variable > 0.

StableSwap.sol

  • L81 - Gas is saved, if instead of uint i = 0; uint i is used; Also, gas is saved if instead of i++, unchecked{++i;} is used

  • L82 - Less gas cost is generated if variable != 0 is used instead of variable > 0.

  • L124 - Gas can be saved, instead of using modifiers, private view functions can be used to avoid gas costs.

  • L201/202/203/342/343/344/360/361/362 - It is not necessary to create a variable that will only be used once, it could be returned directly.

PromiseRouter.sol

  • L139 - Gas can be saved, instead of using modifiers, private view functions can be used to avoid gas costs.

  • L259 - Less gas cost is generated if variable != 0 is used instead of variable > 0.

RelayerFeeRouter.sol

  • L73 - Gas can be saved, instead of using modifiers, private view functions can be used to avoid gas costs.

ProposedOwnable.sol

  • L82/90 - Gas can be saved, instead of using modifiers, private view functions can be used to avoid gas costs.

AmplificationUtils.sol

  • L86 - Less gas cost is generated if variable != 0 is used instead of variable > 0.

  • L84/85/86/92/94/111 - Instead of using a require, you can use custom and ifs() errors

LibCrossDomainProperty.sol

  • L47 - You can save gas, instead of using modifiers, you can use private view functions to avoid generating gas costs.

LibDiamond.sol

  • L100 - Gas can be saved if instead of using requires, customs and ifs() errors are used

  • L104 - Gas is saved if instead of _diamondCut.length a local variable is used and instead of facetIndex++ unchecked{++facetIndex;} is used

  • L121/139/158/226/232/247 - Less gas cost is generated if variable != 0 is used instead of variable > 0.

  • L129/147/162 - Gas is saved if a local variable is used instead of _functionSelectors.length and unchecked{++selectorIndex;} is used instead of selectorIndex++

  • L134/153 - Instead of selectorPosition++ gas could be saved using ++selectorPosition;

  • L66/113/121/123/132/139/141/150/158/161/170/191/193/224/226/228 - Reduce the size of error messages (Long revert Strings) Shortening revert strings to fit in 32 bytes will decrease deployment time gas and will decrease runtime gas when the revert condition is met. Revert strings that are longer than 32 bytes require at least one additional mstore, along with additional overhead for computing memory offset, etc.

PromiseMessage.sol

  • L124/126 - It is not necessary to create a variable that will only be used once, it could be returned directly.

  • L142 - Less gas cost is generated if variable != 0 is used instead of variable > 0.

RelayerFeeMessage.sol

  • L81 - Gas is saved if instead of uint i = 0; the variable is not set.

  • L85 - Instead of i++ you can save gas with ++i;

SwapUtils.sol

  • L205/254/268/289/300/302/344/405/425/558/591/844/869/924/1014/1019/1039/1055 - Gas is saved, if instead of uint i = 0; uint i is used; Also, gas is saved if instead of i++, unchecked{++i;} is used

  • L173 - In the function calculateWithdrawOneTokenDY() a local variable should be created for xp.length, since it generates less gas expense.

  • L986 - In the removeLiquidityImbalance() function, a local variable for pooledTokens.length should be created, since it generates less gas expense.

  • L1053 - In the withdrawAdminFees() function, a local variable for pooledTokens.length should be created, since it generates less gas expense.

  • L369/670/711/765/799/845 - Less gas cost is generated if variable != 0 is used instead of variable > 0.

  • L625/626 - It should be validated that numTokens is > 1, otherwise it will revert due to underflow or division by zero, due to the operation: numTokens.sub(1).

  • L784 - Reduce the size of error messages (Long revert Strings) Shortening revert strings to fit in 32 bytes will decrease deployment time gas and will decrease runtime gas when the revert condition is met. Revert strings that are longer than 32 bytes require at least one additional mstore, along with additional overhead for computing memory offset, etc.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter