Platform: Code4rena
Start Date: 08/11/2022
Pot Size: $60,500 USDC
Total HM: 6
Participants: 72
Period: 5 days
Judge: Picodes
Total Solo HM: 2
Id: 178
League: ETH
Rank: 37/72
Findings: 1
Award: $80.83
🌟 Selected for report: 0
🚀 Solo Findings: 0
80.8321 USDC - $80.83
Solidity version 0.8+ comes with implicit overflow and underflow checks on unsigned integers. When an overflow or an underflow isn't possible, some gas can be saved by using an unchecked
block.
I suggest wrapping with an unchecked
block here:
File contracts/OwnableTwoSteps.sol, line 114: earliestOwnershipRenouncementTime = block.timestamp + delay; File contracts/proxies/SeaportProxy.sol, line 109: if (orders[i].currency == address(0)) ethValue += orders[i].price; File contracts/proxies/SeaportProxy.sol, line 147: uint256 orderFee = (orders[i].price * feeBp) / 10000; File contracts/proxies/SeaportProxy.sol, line 150: fee += orderFee; File contracts/proxies/SeaportProxy.sol, line 207: uint256 orderFee = (price * feeBp) / 10000; File contracts/proxies/SeaportProxy.sol, line 209: fee += orderFee;
The values emitted shouldn't be read from storage. The existing memory values should be used instead in here:
File contracts/OwnableTwoSteps.sol, line 114-116: earliestOwnershipRenouncementTime = block.timestamp + delay; emit InitiateOwnershipRenouncement(earliestOwnershipRenouncementTime);
I suggest code replace:
uint256 _earliestOwnershipRenouncementTime = block.timestamp + delay; earliestOwnershipRenouncementTime = _earliestOwnershipRenouncementTime; emit InitiateOwnershipRenouncement(_earliestOwnershipRenouncementTime);
#0 - c4-judge
2022-11-21T19:03:40Z
Picodes marked the issue as grade-b
#1 - 0xhiroshi
2022-11-22T23:04:11Z
#2 - c4-sponsor
2022-11-22T23:04:23Z
0xhiroshi requested judge review
#3 - 0xhiroshi
2022-11-23T09:43:15Z
For finding no.1, we have decided to reject it and any duplicated findings because it is simply too risky for us to use unchecked
for a number we have no control over. orders[i].price
comes from the frontend and we can't foresee what issues it can bring if there is an overflow/underflow.
@0xJurassicPunk FYI
#4 - 0xhiroshi
2022-12-12T23:20:18Z
@Picodes what is the edict of this report?