Juicebox V2 contest - mrpathfindr's results

The decentralized fundraising and treasury protocol.

General Information

Platform: Code4rena

Start Date: 01/07/2022

Pot Size: $75,000 USDC

Total HM: 17

Participants: 105

Period: 7 days

Judge: Jack the Pug

Total Solo HM: 5

Id: 143

League: ETH

Juicebox

Findings Distribution

Researcher Performance

Rank: 95/105

Findings: 1

Award: $38.23

🌟 Selected for report: 0

🚀 Solo Findings: 0

G012 - Use Prefix Increment instead of Postfix Increment if possible

The prefix increment expression is cheaper in terms of gas.

Consider using the prefix increment expression whenever the return value is not needed.

Instances Include:

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBOperatorStore.sol#L135

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L913

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L1014

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L139

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L167

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L275

Mitigation:

Do

for (uint256 _i = 0; _i < _permissionIndexes.length; ++_i) {}

Instead of

for (uint256 _i = 0; _i < _permissionIndexes.length; _i++) {}

G002 - Cache Array Length Outside of Loop

Description: Caching the array length outside a loop saves reading it on each iteration, as long as the array's length is not changed during the loop.

Instances Include:

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBController.sol#L913

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L139

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L167

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBSingleTokenPaymentTerminalStore.sol#L862

Mitigation:

Define the length of the array outside of the loop

Do

uint256 len = _splits.length; for (uint256 _i = 0; _i < len; _i++) { // Get a reference to the split being iterated on. JBSplit memory _split = _splits[_i]; // The amount to send towards the split. uint256 _tokenCount = PRBMath.mulDiv( _amount, _split.percent, JBConstants.SPLITS_TOTAL_PERCENT );

Instead of

for (uint256 _i = 0; _i < _splits.length; _i++) { // Get a reference to the split being iterated on. JBSplit memory _split = _splits[_i]; // The amount to send towards the split. uint256 _tokenCount = PRBMath.mulDiv( _amount, _split.percent, JBConstants.SPLITS_TOTAL_PERCENT );

G009 - Make Function external instead of public

Description:

Background info:

https://gus-tavo-guim.medium.com/public-vs-external-functions-in-solidity-b46bcf0ba3ac https://ethereum.stackexchange.com/questions/107578/does-using-external-over-public-in-a-library-reduce-any-gas-costs/107939#107939

instances Include:

https://github.com/jbx-protocol/juice-contracts-v2-code4rena/blob/828bf2f3e719873daa08081cfa0d0a6deaa5ace5/contracts/JBDirectory.sol#L162

Mitigation

Do

function isTerminalOf(uint256 _projectId, IJBPaymentTerminal _terminal) external view override returns (bool) { for (uint256 _i; _i < _terminalsOf[_projectId].length; _i++) if (_terminalsOf[_projectId][_i] == _terminal) return true; return false; }

Instead of

function isTerminalOf(uint256 _projectId, IJBPaymentTerminal _terminal) public view override returns (bool) { for (uint256 _i; _i < _terminalsOf[_projectId].length; _i++) if (_terminalsOf[_projectId][_i] == _terminal) return true; return false; }
AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter