Fraxlend (Frax Finance) contest - gerdusx's results

Fraxlend: A permissionless lending platform and the final piece of the Frax Finance Defi Trinity.

General Information

Platform: Code4rena

Start Date: 12/08/2022

Pot Size: $50,000 USDC

Total HM: 15

Participants: 120

Period: 5 days

Judge: Justin Goro

Total Solo HM: 6

Id: 153

League: ETH

Frax Finance

Findings Distribution

Researcher Performance

Rank: 106/120

Findings: 1

Award: $21.17

🌟 Selected for report: 0

🚀 Solo Findings: 0

Gas Optimizations

[G-01] Use prefix not postfix in loops

Using a prefix increment (++i) instead of a postfix increment (i++) saves gas for each loop cycle and so can have a big gas impact when the loop executes on a large number of elements.

There are 8 occurrences

FraxlendPair.sol L289 for (uint256 i = 0; i < _lenders.length; i++) { L308 for (uint256 i = 0; i < _borrowers.length; i++) {

FraxlendPairDeployer.sol L127 for (i = 0; i < _lengthOfArray; ) { L152 for (i = 0; i < _lengthOfArray; ) { L402 for (uint256 i = 0; i < _lengthOfArray; ) {

FraxlendWhitelist.sol L51 for (uint256 i = 0; i < _addresses.length; i++) { L66 for (uint256 i = 0; i < _addresses.length; i++) { L81 for (uint256 i = 0; i < _addresses.length; i++) {

Use prefix not postfix to increment in a loop

[G-02] Short require strings save gas

Strings in solidity are handled in 32 byte chunks. A require string longer than 32 bytes uses more gas. Shortening these strings will save gas.

There are 6 occurrences

FraxlendPairDeployer.sol L253 require(deployedPairsByName[_name] == address(0), "FraxlendPairDeployer: Pair name must be unique"); L365 require(_maxLTV <= GLOBAL_MAX_LTV, "FraxlendPairDeployer: _maxLTV is too large"); L366 require(

LinearInterestRate.sol L57 require( L61 require( L65 require(

Shorten all require strings to less than 32 characters

[G-03] Redundant zero initialization

Solidity does not recognize null as a value, so uint variables are initialized to zero. Setting a uint variable to zero is redundant and can waste gas.

There are 9 occurrences

FraxlendPair.sol L289 for (uint256 i = 0; i < _lenders.length; i++) { L308 for (uint256 i = 0; i < _borrowers.length; i++) {

FraxlendPairCore.sol L265 for (uint256 i = 0; i < _approvedBorrowers.length; ++i) { L270 for (uint256 i = 0; i < _approvedLenders.length; ++i) {

FraxlendPairDeployer.sol L402 for (uint256 i = 0; i < _lengthOfArray; ) {

FraxlendWhitelist.sol L51 for (uint256 i = 0; i < _addresses.length; i++) { L66 for (uint256 i = 0; i < _addresses.length; i++) { L81 for (uint256 i = 0; i < _addresses.length; i++) {

LinearInterestRate.sol L33 uint256 private constant MIN_INT = 0; // 0.00% annual rate

Remove the redundant zero initialization] uint256 amount

[G-04] Use Custom Errors instead of revert()/require()

Custom errors from Solidity 0.8.4 are cheaper than revert strings (cheaper deployment cost and runtime cost when the revert condition is met)

There are 7 occurrences

FraxlendPairDeployer.sol L253 require(deployedPairsByName[_name] == address(0), "FraxlendPairDeployer: Pair name must be unique"); L365 require(_maxLTV <= GLOBAL_MAX_LTV, "FraxlendPairDeployer: _maxLTV is too large"); L366 require( L399 require(msg.sender == CIRCUIT_BREAKER_ADDRESS, "Circuit Breaker only");

LinearInterestRate.sol L57 require( L61 require( L65 require(

Recommended to replace revert strings with custom errors.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter