Badger eBTC Audit + Certora Formal Verification Competition - oualidpro's results

Use stETH to borrow Bitcoin with 0% fees | The only smart contract based #BTC.

General Information

Platform: Code4rena

Start Date: 24/10/2023

Pot Size: $149,725 USDC

Total HM: 7

Participants: 52

Period: 21 days

Judge: ronnyx2017

Total Solo HM: 2

Id: 300

League: ETH

eBTC Protocol

Findings Distribution

Researcher Performance

Rank: 16/52

Findings: 1

Award: $162.76

Gas:

grade-a

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository eBTC Protocol

Findings Information

🌟 Selected for report: DavidGiladi

Also found by: 0xhex, 0xta, Collinsoden, JCK, Madalad, SAQ, SY_S, Sathish9098, cheatc0d3, codeslide, hihen, hunter_w3b, jamshed, lsaudit, mgf15, nonseodion, oualidpro, petrichor, sivanesh_808, tala7985, unique, ybansal2403, zabihullahazadzoi

Awards

162.763 USDC - $162.76

Labels

bug

G (Gas Optimization)

grade-a

sufficient quality report

G-24

External Links

Link to GitHub issue

Summary

Gas Optimizations

	Issue	Instances	Total Gas Saved
[GAS‑1]	Multiple accesses of a mapping/array should use a local variable cache	4	168
[GAS‑2]	Use assembly to calculate hashes to save gas	15	1200
[GAS‑3]	Use assembly to check for `address(0)`	29	174
[GAS‑4]	Optimize Address Storage Value Management with `assembly`	23	-
[GAS‑5]	Use assembly to emit events	88	3344
[GAS‑6]	Avoid contract existence checks by using low level calls	10	1000
[GAS‑7]	Using bools for storage incurs overhead	14	1400
[GAS‑8]	Cache array length outside of loop	5	485
[GAS‑9]	State variables should be cached in stack variables rather than re-reading them from storage	2	194
[GAS‑10]	Use calldata instead of memory for function arguments that do not get mutated	4	-
[GAS‑11]	Add `unchecked {}` for subtractions where the operands cannot underflow because of a previous `require()` or `if`-statement	13	1105
[GAS‑12]	Don't compare boolean expressions to boolean literals	1	9
[GAS‑13]	Use custom errors rather than `revert()`/`require()` strings to save gas	148	-
[GAS‑14]	Divisions which do not divide by -X cannot overflow or overflow so such operations can be unchecked to save gas	35	-
[GAS‑15]	Do not calculate constants	1	-
[GAS‑16]	Stack variable cost less while used in emiting event	9	900
[GAS‑17]	Superfluous event fields	3	-
[GAS‑18]	Events should be emitted outside of loops	1	375
[GAS‑19]	The result of function calls should be cached rather than re-calling the function	1	-
[GAS‑20]	`require()` or `revert()` statements that check input arguments should be at the top of the function	3	-
[GAS‑21]	`internal` functions only called once can be inlined to save gas	75	1500
[GAS‑22]	`internal` functions not called by the contract should be removed to save deployment gas	6	-
[GAS‑23]	`require()`/`revert()` strings longer than 32 bytes cost extra gas	115	2070
[GAS‑24]	Consider merging sequential for loops	4	-
[GAS‑25]	Reduce gas usage by moving to Solidity 0.8.19 or later	39	-
[GAS‑26]	Multiple `address`/ID mappings can be combined into a single `mapping` of an `address`/ID to a `struct`, where appropriate	6	-
[GAS‑27]	Optimize names to save gas	37	814
[GAS‑28]	Not using the named return variables anywhere in the function is confusing	8	-
[GAS‑29]	Structs can be packed into fewer storage slots	3	6000
[GAS‑30]	Constructors can be marked `payable`	19	399
[GAS‑31]	Using `private` rather than `public` for constants, saves gas	31	-
[GAS‑32]	`private` functions only called once can be inlined to save gas	2	-
[GAS‑33]	Remove or replace unused state variables	2	-
[GAS‑34]	Redundant else statement	11	-
[GAS‑35]	Avoid updating storage when the value hasn't changed to save gas	21	16800
[GAS‑36]	Use shift Right instead of division if possible to save gas	3	60
[GAS‑37]	Use shift Left instead of multiplication if possible to save gas	1	-
[GAS‑38]	Usage of `uints`/`ints` smaller than 32 bytes (256 bits) incurs overhead	43	-
[GAS‑39]	The use of a logical AND in place of double if is slightly less gas efficient in instances where there isn't a corresponding else statement for the given if statement	14	210
[GAS‑40]	Splitting `require()` statements that use `&&` saves gas	8	24
[GAS‑41]	Stack variable used as a cheaper cache for a state variable is only used once	1	3
[GAS‑42]	Cache state variables outside of loop to avoid reading storage on every iteration	8	-
[GAS‑43]	`>=`/`<=` costs less gas than `>`/`<`	113	339
[GAS‑44]	Ternary unnecessary	3	-
[GAS‑45]	Use assembly to validate `msg.sender`	39	468
[GAS‑46]	Can make the variable outside the loop to save gas	16	-
[GAS‑47]	`++i` costs less gas than `i++`, especially when it's used in `for`-loops (`--i`/`i--` too)	15	-
[GAS‑48]	Structs can be packed into fewer storage slots by truncating timestamp bytes	2	-
[GAS‑49]	Stat variables can be packed into fewer storage slots by truncating timestamp bytes	1	-
[GAS‑50]	Using mappings instead of arrays to avoid length checks save gas	1	-
[GAS‑51]	State variables can be packed into fewer storage slots	2	4000
[GAS‑52]	Use `do while` loops instead of `for` loops	15	1815
[GAS‑53]	Use `+=` for `mapping`s	2	-
[GAS‑54]	Avoid transferring amounts of zero in order to save gas	4	-
[GAS‑55]	When no `addresses` are used `abi.encodepacked()` Outperforms `abi.encode()` in Efficiency	2	122
[GAS‑56]	Simple checks for zero `uint` can be done using assembly to save gas	31	186
[GAS‑57]	`++i`/`i++` should be `unchecked{++i}`/`unchecked{i++}` when it is not possible for them to overflow, as is the case when used in `for`- and `while`-loops	10	-

Total: 1122 instances over 57 issues with 45164 gas saved

Gas Optimizations

[GAS‑1] Multiple accesses of a mapping/array should use a local variable cache

The instances below point to the second+ access of a value inside a mapping/array, within a function. Caching a mapping's value in a local storage or calldata variable when the value is accessed multiple times, saves ~42 gas per access due to not having to recalculate the key's keccak256 hash (Gkeccak256 - 30 gas) and that calculation's associated stack operations. Caching an array's struct avoids recalculating the array offsets into memory/calldata

There are 4 instances of this issue:

<details> <summary>see instances</summary>

File: packages/contracts/contracts/CdpManagerStorage.sol

// @audit Cdps[_cdpId]
272:         Cdps[_cdpId].coll = 0;

Badger eBTC Audit + Certora Formal Verification Competition - oualidpro's results

Use stETH to borrow Bitcoin with 0% fees | The only smart contract based #BTC.

General Information

Findings Distribution

Researcher Performance

External Links

[G-24] Gas Report - $162.76

Findings Information

Awards

Labels

External Links

Summary

Gas Optimizations

Gas Optimizations

[GAS‑1] Multiple accesses of a mapping/array should use a local variable cache

[GAS‑2] Use assembly to calculate hashes to save gas

[GAS‑3] Use assembly to check for address(0)

[GAS‑4] Optimize Address Storage Value Management with assembly

[GAS‑5] Use assembly to emit events

[GAS‑6] Avoid contract existence checks by using low level calls

[GAS‑7] Using bools for storage incurs overhead

[GAS‑8] Cache array length outside of loop

[GAS‑9] State variables should be cached in stack variables rather than re-reading them from storage

[GAS‑10] Use calldata instead of memory for function arguments that do not get mutated

[GAS‑11] Add unchecked {} for subtractions where the operands cannot underflow because of a previous require() or if-statement

[GAS‑12] Don't compare boolean expressions to boolean literals

[GAS‑13] Use custom errors rather than revert()/require() strings to save gas

[GAS‑14] Divisions which do not divide by -X cannot overflow or overflow so such operations can be unchecked to save gas

[GAS‑15] Do not calculate constants

[GAS‑16] Stack variable cost less while used in emiting event

[GAS‑17] Superfluous event fields

[GAS‑18] Events should be emitted outside of loops

[GAS‑19] The result of function calls should be cached rather than re-calling the function

[GAS‑20] require() or revert() statements that check input arguments should be at the top of the function

[GAS‑21] internal functions only called once can be inlined to save gas

[GAS‑22] internal functions not called by the contract should be removed to save deployment gas

[GAS‑23] require()/revert() strings longer than 32 bytes cost extra gas

[GAS‑24] Consider merging sequential for loops

[GAS‑25] Reduce gas usage by moving to Solidity 0.8.19 or later

[GAS‑26] Multiple address/ID mappings can be combined into a single mapping of an address/ID to a struct, where appropriate

[GAS‑27] Optimize names to save gas

[GAS‑28] Not using the named return variables anywhere in the function is confusing

[GAS‑29] Structs can be packed into fewer storage slots

[GAS‑30] Constructors can be marked payable

[GAS‑31] Using private rather than public for constants, saves gas

[GAS‑32] private functions only called once can be inlined to save gas

[GAS‑33] Remove or replace unused state variables

[GAS‑34] Redundant else statement

[GAS‑35] Avoid updating storage when the value hasn't changed to save gas

[GAS‑36] Use shift Right instead of division if possible to save gas

[GAS‑37] Use shift Left instead of multiplication if possible to save gas

[GAS‑38] Usage of uints/ints smaller than 32 bytes (256 bits) incurs overhead

[GAS‑39] The use of a logical AND in place of double if is slightly less gas efficient in instances where there isn't a corresponding else statement for the given if statement

[GAS‑40] Splitting require() statements that use && saves gas

[GAS‑41] Stack variable used as a cheaper cache for a state variable is only used once

[GAS‑42] Cache state variables outside of loop to avoid reading storage on every iteration

[GAS‑43] >=/<= costs less gas than >/<

[GAS‑44] Ternary unnecessary

[GAS‑45] Use assembly to validate msg.sender

[GAS‑46] Can make the variable outside the loop to save gas

[GAS‑47] ++i costs less gas than i++, especially when it's used in for-loops (--i/i-- too)

[GAS‑48] Structs can be packed into fewer storage slots by truncating timestamp bytes

[GAS‑49] Stat variables can be packed into fewer storage slots by truncating timestamp bytes

[GAS‑50] Using mappings instead of arrays to avoid length checks save gas

[GAS‑51] State variables can be packed into fewer storage slots

[GAS‑52] Use do while loops instead of for loops

[GAS‑53] Use += for mappings

[GAS‑54] Avoid transferring amounts of zero in order to save gas

[GAS‑55] When no addresses are used abi.encodepacked() Outperforms abi.encode() in Efficiency

[GAS‑56] Simple checks for zero uint can be done using assembly to save gas

[GAS‑57] ++i/i++ should be unchecked{++i}/unchecked{i++} when it is not possible for them to overflow, as is the case when used in for- and while-loops

#0 - c4-pre-sort2023-11-17T14:53:32Z

#1 - c4-judge2023-11-25T11:36:14Z

#2 - jhsagd762023-12-06T20:49:58Z

#3 - c4-judge2023-12-06T20:51:11Z

[GAS‑3] Use assembly to check for `address(0)`

[GAS‑4] Optimize Address Storage Value Management with `assembly`

[GAS‑11] Add `unchecked {}` for subtractions where the operands cannot underflow because of a previous `require()` or `if`-statement

[GAS‑13] Use custom errors rather than `revert()`/`require()` strings to save gas

[GAS‑20] `require()` or `revert()` statements that check input arguments should be at the top of the function

[GAS‑21] `internal` functions only called once can be inlined to save gas

[GAS‑22] `internal` functions not called by the contract should be removed to save deployment gas

[GAS‑23] `require()`/`revert()` strings longer than 32 bytes cost extra gas

[GAS‑26] Multiple `address`/ID mappings can be combined into a single `mapping` of an `address`/ID to a `struct`, where appropriate

[GAS‑30] Constructors can be marked `payable`

[GAS‑31] Using `private` rather than `public` for constants, saves gas

[GAS‑32] `private` functions only called once can be inlined to save gas

[GAS‑38] Usage of `uints`/`ints` smaller than 32 bytes (256 bits) incurs overhead

[GAS‑40] Splitting `require()` statements that use `&&` saves gas

[GAS‑43] `>=`/`<=` costs less gas than `>`/`<`

[GAS‑45] Use assembly to validate `msg.sender`

[GAS‑47] `++i` costs less gas than `i++`, especially when it's used in `for`-loops (`--i`/`i--` too)

[GAS‑52] Use `do while` loops instead of `for` loops

[GAS‑53] Use `+=` for `mapping`s

[GAS‑55] When no `addresses` are used `abi.encodepacked()` Outperforms `abi.encode()` in Efficiency

[GAS‑56] Simple checks for zero `uint` can be done using assembly to save gas

[GAS‑57] `++i`/`i++` should be `unchecked{++i}`/`unchecked{i++}` when it is not possible for them to overflow, as is the case when used in `for`- and `while`-loops

#0 - c4-pre-sort
2023-11-17T14:53:32Z

#1 - c4-judge
2023-11-25T11:36:14Z

#2 - jhsagd76
2023-12-06T20:49:58Z

#3 - c4-judge
2023-12-06T20:51:11Z