Putty contest - hake's results

An order-book based american options market for NFTs and ERC20s.

General Information

Platform: Code4rena

Start Date: 29/06/2022

Pot Size: $50,000 USDC

Total HM: 20

Participants: 133

Period: 5 days

Judge: hickuphh3

Total Solo HM: 1

Id: 142

League: ETH

Putty

Findings Distribution

Researcher Performance

Rank: 71/133

Findings: 2

Award: $68.32

🌟 Selected for report: 0

🚀 Solo Findings: 0

QA Report

[N-01] Spec in wrong order in relation to code

Spec: "Accepts a counter offer for an order. It fills the counter offer, and then cancels the original order that the counter offer was made for."

Code:

// cancel the original order
        cancel(originalOrder);

        // accept the counter offer
        uint256[] memory floorAssetTokenIds = new uint256[](0);
        positionId = fillOrder(order, signature, floorAssetTokenIds);
    }

Original order is cancelled before counter order is filled.

https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L563

Gas Report

[G-01] Missing zero address check

Contract would have to be redeployed if weth address was mistakenly set to zero. https://github.com/code-423n4/2022-06-putty/blob/main/contracts/src/PuttyV2.sol#L218

[G-02] for loop gas optimisation

for (uint256 i = 0; i < orders.length; i++) {
    positionIds[i] = fillOrder(orders[i], signatures[i], floorAssetTokenIds[i]);
}

Gas could be saved by:

  • Not initializing variable to default value of zero
  • Caching array length
  • Using a prefix (++i) instead of a postfix (i++)
  • Unchecking increment count

Example:


uint length = orders.length;
for (uint256 i; i < length;) {
    positionIds[i] = fillOrder(orders[i], signatures[i], floorAssetTokenIds[i]);
		unchecked { ++i; }
}

https://github.com/code-423n4/2022-06-putty/blob/main/contracts/src/PuttyV2.sol#L556

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter