Rigor Protocol contest - fatherOfBlocks's results

Community lending and instant payments for new home construction.

General Information

Platform: Code4rena

Start Date: 01/08/2022

Pot Size: $50,000 USDC

Total HM: 26

Participants: 133

Period: 5 days

Judge: Jack the Pug

Total Solo HM: 6

Id: 151

League: ETH

Rigor Protocol

Findings Distribution

Researcher Performance

Rank: 51/133

Findings: 2

Award: $86.51

🌟 Selected for report: 0

🚀 Solo Findings: 0

HomeFiProxy

  • 206/353/381/775 - During the code several token transfers are made, in one it is an address entered by the user and in others it is an address set by the deployer, as we do not know how the transfer() is implemented internally and the ERC20 transfer returns a true or false, it should be validated that the validation returns a true, otherwise it would modify the state of the contract and leave it inconsistent.

Disputes

  • L9 - El import de ContextUpgradeable no es utilizado en el codigo.

HomeFi

  • L46/48/66 - There are multiple variables in storage that are set in a function, but are never used, such as: communityContract, disputesContract and wrappedToken.

  • L264 - There are functions that are public and nobody calls them inside the contract, therefore it should only be external, like for example: isTrustedForwarder().

#0 - zgorizzo69

2022-08-09T08:54:55Z

  • homefiproxy only has 231 lines
  • homefi act as a registry for contract address such as disputesContract, wrappedToken
  • isTrustedForwarder can't be made external

Community

  • L67/69/73/75/79/81/88/90/131/159/191/235/241/248/251/312/347/353/384/400/491/536/539/557/568 - The modifier function can generate much less cost if a private view function is used. In addition, the require can be modified by an if and custom errors, this would generate much less gas costs.

  • L140/198/624- It is less expensive to do ++i, than i++ or i + 1, without modifying the understanding of the code.

  • L261/427/764/840 - It is less expensive to make "variable != 0" than "variable > 0", without generating modifications in the understanding.

  • L624 - It is not necessary to set a variable with its default value, since it has that value defined by default.

  • L624 - When we use the length in a for loop it is better to use a variable in memory instead of constantly querying the length, for example in this line we have this query: _communities[_communityID].memberCount.

  • L768/781 - The variable is created in Storage _communityProject where it is created but then it is used much further down, this means that if it reverts in the middle, gas is spent on bringing a storage value that was never used, generating an expense extra gas.

  • L794 - The operation _lentAndInterest - _repayAmount can be unchecked since lines before it was validated that _lentAndInterest >= _repayAmount.

  • L836/837/843 - The variable is created in Storage _communityProject and _lender where it is created but then it is used much further down inside the if(), this means that if the validation does not pass, gas is spent on creating those variables that they were never used, generating an extra gas expense.

HomeFi

  • L72/73/77/78/82/84/142/191 - The modifier function can generate much less cost if a private view function is used. In addition, the require can be modified by an if and custom errors, this would generate much less gas costs.

  • L245 - It is less expensive to make "variable != 0" than "variable > 0", without generating modifications in the understanding.

Disputes

  • L37/39/43/46/50/52/60/61/183 - La funcion modifier puede generar mucho menor costo si se utilizara una funcion private view. Ademas el require puede ser modificado por un if y errores custom, esto generaria mucho menos costos de gas.

  • L107 - Es menos costoso hacer "variable != 0" que "variable > 0", sin generar modificaciones en el entendimiento.

  • L121 - Es menos costoso hacer ++i, que i++, sin modificar el entendimiento del codigo.

HomeFiProxy

  • L40/41/105 - The modifier function can generate much less cost if a private view function is used. In addition, the require can be modified by an if and custom errors, this would generate much less gas costs.

  • L87/136 - It is not necessary to set a variable with its default value, since it has that value defined by default.

  • L87/136 - It is less expensive to do ++i, than i++, without modifying the understanding of the code.

Project

  • L68/78 - In storage there are two bools (contractorConfirmed and contractorDelegated) that are individually surrounded by many uint256, they could be together and the space in storage would be optimized.

  • L123/132/135/150/153/176/189/195/199/238/241/245/277/301/308/341/406/515/521/530/886/906 - Also the require can be Modified by an if and custom errors, this would result in much lower gas costs.

  • L195/380/601/691/710 - It is less expensive to make "variable != 0" than "variable > 0", without generating modifications in the understanding.

  • L248/311/322/412 - It is not necessary to set a variable with its default value, since it has that value defined by default.

  • L253/256/601/603 - When a variable is used several times, gas can be saved by creating a variable in memory, an example of this is: _taskCosts[i].

  • L248/311/322/368/603/625/672 - It is less expensive to do ++i, than i++, without modifying the understanding of the code.

DebtToken

  • L29/31/50 - The modifier function can generate much less cost if a private view function is used. In addition, the require can be modified by an if and custom errors, this would generate much less gas costs.

ProjectFactory

  • L34/36/64/84 - The modifier function can generate much less cost if a private view function is used. In addition, the require can be modified by an if and custom errors, this would generate much less gas costs.

#0 - zgorizzo69

2022-08-09T08:45:50Z

muchas gracias por su trabajo :es: ! :+1: for storage order in project.sol

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter