Platform: Code4rena
Start Date: 04/05/2022
Pot Size: $50,000 DAI
Total HM: 24
Participants: 71
Period: 5 days
Judge: Justin Goro
Total Solo HM: 14
Id: 119
League: ETH
Rank: 43/71
Findings: 2
Award: $116.33
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: horsefacts
Also found by: 0x1f8b, 0xYamiDancho, 0xf15ers, 0xkatana, ACai, AlleyCat, Bruhhh, Dravee, Funen, GimelSec, Hawkeye, IllIllI, MaratCerby, PPrieditis, Picodes, Ruhum, TerrierLover, VAD37, berndartmueller, csanuragjain, defsec, delfin454000, eccentricexit, ellahi, fatherOfBlocks, gzeon, hansfriese, hickuphh3, hyh, ilan, joestakey, juicy, kebabsec, oyc_109, rajatbeladiya, reassor, rfa, robee, samruna, simon135, sorrynotsorry, throttle
74.7635 DAI - $74.76
Non-critical Issues
NatSpec is incomplete @param is missing MerkleIdentity.sol#L140 VoterID.sol#L411 @return is missing MerkleIdentity.sol#L163 VoterID.sol#L397 VoterID.sol#L402
Spelling issues PermissionlessBasicPoolFactory.sol#L183 -> "Cannot deposit before pool starts"
Wrong comment PermissionlessBasicPoolFactory.sol#L205 Only receipt owner may call this function while pool is alive but anyone can do after pool ends
Wrong error message PermissionlessBasicPoolFactory.sol#L214 -> "Can only withdraw your own deposit while pool is alive"
#0 - illuzen
2022-05-10T09:40:04Z
duplicates
🌟 Selected for report: IllIllI
Also found by: 0x1f8b, 0xNazgul, 0xYamiDancho, 0xf15ers, 0xkatana, ACai, CertoraInc, Dravee, Funen, GimelSec, Hawkeye, PPrieditis, Picodes, Ruhum, TerrierLover, Tomio, VAD37, Waze, csanuragjain, defsec, delfin454000, eccentricexit, ellahi, fatherOfBlocks, gzeon, hansfriese, horsefacts, ilan, joestakey, juicy, minhquanym, oyc_109, rajatbeladiya, reassor, rfa, robee, samruna, simon135, z3s
41.5699 DAI - $41.57
use != 0 instead of > 0 FixedPricePassThruGate.sol#L51 MerkleVesting.sol#L147 VoterID.sol#L348
use ++i instead of i++, i+=1 MerkleEligibility.sol#L47 MerkleLib.sol#L22 PermissionlessBasicPoolFactory.sol#L115 PermissionlessBasicPoolFactory.sol#L141 PermissionlessBasicPoolFactory.sol#L168 PermissionlessBasicPoolFactory.sol#L190 PermissionlessBasicPoolFactory.sol#L224 PermissionlessBasicPoolFactory.sol#L249 PermissionlessBasicPoolFactory.sol#L266 VoterID.sol#L130 VoterID.sol#L140 VoterID.sol#L333
check require() at the start time of function You can move this line to the first line of function PermissionlessBasicPoolFactory.sol#L112
no need to initialize variables with default values MerkleDropFactory.sol#L17 MerkleEligibility.sol#L31 MerkleLib.sol#L22 MerkleResistor.sol#L24 MerkleResistor.sol#L176 MerkleVesting.sol#L16 MerkleVesting.sol#L150 PermissionlessBasicPoolFactory.sol#L115 PermissionlessBasicPoolFactory.sol#L141 PermissionlessBasicPoolFactory.sol#L168 PermissionlessBasicPoolFactory.sol#L224 PermissionlessBasicPoolFactory.sol#L249 PermissionlessBasicPoolFactory.sol#L266 VoterID.sol#L69
change storage to memory if possible PermissionlessBasicPoolFactory.sol#L157 PermissionlessBasicPoolFactory.sol#L262 PermissionlessBasicPoolFactory.sol#L280 PermissionlessBasicPoolFactory.sol#L293 PermissionlessBasicPoolFactory.sol#L306 PermissionlessBasicPoolFactory.sol#L307
you can add require() to avoid unnecessary calculations MerkleDropFactory.sol#L68 you can add this require at #L69 require(treeIndex <= numTrees, "Provided merkle index doesn't exist");
you can check success inside "for" loop to avoid unnecessary calculations PermissionlessBasicPoolFactory.sol#L141-L147 PermissionlessBasicPoolFactory.sol#L224-L231 PermissionlessBasicPoolFactory.sol#L249-L253 PermissionlessBasicPoolFactory.sol#L266-L270
Currently it iterates all of the loop even if success = false in the middle. It would be good to check require() for success inside the "for" loop after transaction so that it can revoke without doing unnecessary calculations anymore. require(success, 'Token transfer failed');
#0 - illuzen
2022-05-10T09:39:25Z
duplicates