Olympus DAO contest - fatherOfBlocks's results

Version 3 of Olympus protocol, a decentralized floating currency.

General Information

Platform: Code4rena

Start Date: 25/08/2022

Pot Size: $75,000 USDC

Total HM: 35

Participants: 147

Period: 7 days

Judge: 0xean

Total Solo HM: 15

Id: 156

League: ETH

Olympus DAO

Findings Distribution

Researcher Performance

Rank: 69/147

Findings: 2

Award: $87.23

🌟 Selected for report: 0

🚀 Solo Findings: 0

Kernel.sol

  • L236 to L258 - This type of validation structure can be replaced by a switch, where the parameter passed first is action and then each case is the value of the Actions enum.

  • L439 - Currently the functionalities of setting the role to an address and creating a new role are coupled. This can generate confusion since unconsciously roles can be created due to mistakes in the name of the role, since that is not really the objective. Therefore, it would be best to have a function to create a new role and another function to grant the role to a specific address.

TRSRY.sol

  • L20/24/27/28/29/33/36/39/59/66/77/92/105/123/139 - In multiple functions, an ERC20 with the name token_ is requested as input, mostly. But no internal function of this type of token is ever used. This generates extra gas costs, since it could simply be used as an address.

  • L33/37 - The Executor can define who mints and burns tokens, this has a very high centralization point, since the address that has access to it, passing the require permissioned, will be able to burn and mint tokens to whoever it wants. Generating a very high risk point.

VOTES.sol

  • L35/39/51 - The Executor can define who lies, burns and transfers the token of whoever he wants, this has a very high centralization point, since the address that has access to it, pass the require permissioned, can burn, lie and transfer tokens to whoever he wants. Generating a very high risk point.

RANGE.sol

  • L33 - If the struct that is created has only one element, it would be nicer for it to be just a variable and not a struct.

Kernel.sol

  • L70/88/119/223/229 - Gas can be saved if instead of using a modifier a private view function is used, this would reduce all the costs of validating the access control of an address.

  • L397 - When you want to set a variable with its default value, it is less expensive not to set it since it has that default value, this reduces some gas units without losing understanding of the code.

KernelUtils.sol

  • L43/58 - When you want to set a variable with its default value, it is less expensive not to set it since it has that default value, this reduces some gas units without losing understanding of the code.

  • L49/64 - It is less expensive to do the ++i operation than to do i++, without losing understanding of the code.

TRSRY.sol

  • L131/132 - When previously it is validated that the operation returns a value without overflow/underflow, it can be wrapped with unchecked in order to spend less gas when performing the mathematical operation. What could be unchecked is the operation, not the validation of the if.

PRICE.sol

  • L6 - The ERC20 class is imported, but it is never used, this generates unnecessary extra gas costs.

  • L136/138 - When it is previously validated that the operation returns a value without overflow/underflow, it can be wrapped with unchecked in order to spend less gas when performing the mathematical operation. What could be unchecked is the operation, not the validation of the if.

BondCallback.sol

  • L120 - It is necessary to validate that outputAmount_ > inputAmount_ so that it does not throw an exception without any underflow message. In addition, the outputAmount_ - inputAmount_ operation can become unchecked so that what has already been validated is not validated.

  • L223/306 - Instead of validating "validation == true" or "validation == false" it is much simpler and less expensive to validate "validation" or "!validation".

  • L278 - In a for loop instead of consulting the length of the array to be iterated in each iteration, the least expensive thing is to create a variable in memory of the value of array.length

RANGE.sol

  • L133/145 - It is less expensive in a validation that the less expensive operation is ahead, since it avoids executing the second more expensive validation.

Heart.sun

  • L26 - an error is created that is not used anywhere, it should be eliminated.

TreasuryCustodian.sol

  • L11 - an error is created that is not used anywhere, it should be eliminated.

Operator.sol

  • L188 - The modifier can generate much less gas cost, if instead of a modifier it were a private view function.

  • L488/670/675 - It is less expensive to make ++variable than to make variable++, without modifying the understanding of the code.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter