Axelar Network v2 contest - owenthurm's results

Decentralized interoperability network.

General Information

Platform: Code4rena

Start Date: 29/07/2022

Pot Size: $50,000 USDC

Total HM: 6

Participants: 75

Period: 5 days

Judge: GalloDaSballo

Total Solo HM: 3

Id: 149

League: ETH

Axelar Network

Findings Distribution

Researcher Performance

Rank: 73/75

Findings: 1

Award: $31.22

🌟 Selected for report: 0

🚀 Solo Findings: 0

Variables should not be initialized to defaults (uint256 default is 0): contracts/AxelarGateway.sol::207 => for (uint256 i = 0; i < symbols.length; i++) { contracts/auth/AxelarAuthWeighted.sol::68 => uint256 totalWeight = 0; contracts/auth/AxelarAuthWeighted.sol::69 => for (uint256 i = 0; i < weightsLength; ++i) { contracts/auth/AxelarAuthWeighted.sol::94 => uint256 operatorIndex = 0; contracts/auth/AxelarAuthWeighted.sol::95 => uint256 weight = 0; contracts/auth/AxelarAuthWeighted.sol::98 => for (uint256 i = 0; i < signatures.length; ++i) {

Length of array should be computed outside of for-loop: contracts/AdminMultisigBase.sol::149 => uint256 adminLength = accounts.length; contracts/AxelarGateway.sol::49 => if (authModule.code.length == 0) revert InvalidAuthModule(); contracts/AxelarGateway.sol::50 => if (tokenDeployerImplementation.code.length == 0) revert InvalidTokenDeployer(); contracts/AxelarGateway.sol::205 => if (symbols.length != limits.length) revert InvalidSetDailyMintLimitsParams(); contracts/AxelarGateway.sol::207 => for (uint256 i = 0; i < symbols.length; i++) { contracts/AxelarGateway.sol::228 => if (setupParams.length != 0) { contracts/AxelarGateway.sol::255 => if (newOperatorsData.length > 0) { contracts/AxelarGateway.sol::288 => uint256 commandsLength = commandIds.length; contracts/AxelarGateway.sol::290 => if (commandsLength != commands.length || commandsLength != params.length) revert InvalidCommands(); contracts/AxelarGateway.sol::355 => if (tokenAddress.code.length == uint256(0)) revert TokenContractDoesNotExist(tokenAddress); contracts/AxelarGateway.sol::388 => if (!success || (returnData.length != uint256(0) && !abi.decode(returnData, (bool)))) revert BurnFailed(symbol); contracts/AxelarGateway.sol::462 => return success && (returnData.length == uint256(0) || abi.decode(returnData, (bool))); contracts/AxelarGatewayProxy.sol::19 => if (gatewayImplementation.code.length == 0) revert InvalidImplementation(); contracts/DepositHandler.sol::23 => if (callee.code.length == 0) revert NotContract(); contracts/ECDSA.sol::32 => // Check the signature length contracts/ECDSA.sol::33 => if (signature.length != 65) revert InvalidSignatureLength(); contracts/ECDSA.sol::75 => // 32 is the length in bytes of hash, contracts/auth/AxelarAuthWeighted.sol::17 => for (uint256 i; i < recentOperators.length; ++i) { contracts/auth/AxelarAuthWeighted.sol::60 => uint256 operatorsLength = newOperators.length; contracts/auth/AxelarAuthWeighted.sol::61 => uint256 weightsLength = newWeights.length; contracts/auth/AxelarAuthWeighted.sol::93 => uint256 operatorsLength = operators.length; contracts/auth/AxelarAuthWeighted.sol::98 => for (uint256 i = 0; i < signatures.length; ++i) { contracts/auth/AxelarAuthWeighted.sol::116 => for (uint256 i; i < accounts.length - 1; ++i) { contracts/deposit-service/AxelarDepositService.sol::114 => for (uint256 i; i < refundTokens.length; i++) { contracts/deposit-service/AxelarDepositService.sol::168 => for (uint256 i; i < refundTokens.length; i++) { contracts/deposit-service/AxelarDepositService.sol::204 => for (uint256 i; i < refundTokens.length; i++) { contracts/deposit-service/DepositBase.sol::32 => if (symbolBytes.length == 0 || symbolBytes.length > 31) revert InvalidSymbol(); contracts/deposit-service/DepositBase.sol::36 => // Storing string length as the last byte of the data contracts/deposit-service/DepositBase.sol::37 => symbolNumber |= 0xff & symbolBytes.length; contracts/deposit-service/DepositBase.sol::49 => // recovering string length as the last byte of the data contracts/deposit-service/DepositBase.sol::50 => uint256 length = 0xff & uint256(symbolData); contracts/deposit-service/DepositBase.sol::52 => // restoring the string with the correct length contracts/deposit-service/DepositBase.sol::58 => // store length in memory contracts/deposit-service/DepositBase.sol::59 => mstore(symbol, length) contracts/deposit-service/DepositBase.sol::72 => bool transferred = success && (returnData.length == uint256(0) || abi.decode(returnData, (bool))); contracts/deposit-service/DepositBase.sol::74 => if (!transferred || tokenAddress.code.length == 0) revert TokenTransferFailed(); contracts/gas-service/AxelarGasService.sol::123 => for (uint256 i; i < tokens.length; i++) { contracts/gas-service/AxelarGasService.sol::159 => bool transferred = success && (returnData.length == uint256(0) || abi.decode(returnData, (bool))); contracts/gas-service/AxelarGasService.sol::161 => if (!transferred || tokenAddress.code.length == 0) revert TransferFailed(); contracts/gas-service/AxelarGasService.sol::175 => bool transferred = success && (returnData.length == uint256(0) || abi.decode(returnData, (bool))); contracts/gas-service/AxelarGasService.sol::177 => if (!transferred || tokenAddress.code.length == 0) revert TransferFailed(); contracts/interfaces/IAxelarForecallable.sol::133 => bool transferred = success && (returnData.length == uint256(0) || abi.decode(returnData, (bool))); contracts/interfaces/IAxelarForecallable.sol::135 => if (!transferred || tokenAddress.code.length == 0) revert TransferFailed(); contracts/interfaces/IAxelarForecallable.sol::146 => bool transferred = success && (returnData.length == uint256(0) || abi.decode(returnData, (bool))); contracts/interfaces/IAxelarForecallable.sol::148 => if (!transferred || tokenAddress.code.length == 0) revert TransferFailed(); contracts/util/Upgradable.sol::50 => if (params.length > 0) {

!= is more efficient than > 0 for uint comparisons: contracts/AxelarGateway.sol::255 => if (newOperatorsData.length > 0) { contracts/AxelarGateway.sol::613 => if (limit > 0 && amount > limit) revert ExceedDailyMintLimit(symbol); contracts/ECDSA.sol::58 => if (uint256(s) > 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0) revert InvalidS(); contracts/ERC20Permit.sol::45 => if (uint256(s) > 0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0) revert InvalidS(); contracts/auth/AxelarAuthWeighted.sol::76 => if (epochForHash[newOperatorsHash] > 0) revert SameOperators(); contracts/deposit-service/AxelarDepositService.sol::165 => if (addressForNativeDeposit(salt, refundAddress, destinationChain, destinationAddress).balance > 0 && msg.sender != refundAddress) contracts/deposit-service/ReceiverImplementation.sol::23 => if (address(this).balance > 0) refundAddress.transfer(address(this).balance); contracts/deposit-service/ReceiverImplementation.sol::51 => if (address(this).balance > 0) refundAddress.transfer(address(this).balance); contracts/deposit-service/ReceiverImplementation.sol::71 => if (address(this).balance > 0) refundAddress.transfer(address(this).balance); contracts/gas-service/AxelarGasService.sol::128 => if (amount > 0) receiver.transfer(amount); contracts/gas-service/AxelarGasService.sol::131 => if (amount > 0) _safeTransfer(token, receiver, amount); contracts/util/Upgradable.sol::50 => if (params.length > 0) {

Switching from division/multiplication to right-shift/left-shift can save gas: contracts/ECDSA.sol::56 => // vice versa. If your library also generates signatures with 0/1 for v instead 27/28, add 27 to v to accept contracts/ERC20.sol::15 => * https://forum.zeppelin.solutions/t/how-to-implement-erc20-supply-mechanisms/226[How contracts/interfaces/IERC20.sol::49 => * https://github.com/ethereum/EIPs/issues/20#issuecomment-263524729 contracts/test/gmp/DestinationChainTokenSwapper.sol::29 => convertedAmount = amount * 2; contracts/test/gmp/DestinationChainTokenSwapper.sol::33 => convertedAmount = amount / 2;

#0 - re1ro

2022-08-05T04:27:48Z

Dup #2

Switching from division/multiplication to right-shift/left-shift can save gas:

Ack

#1 - GalloDaSballo

2022-08-23T01:01:30Z

This is really low quality and I'll penalize.

Less than 100 gas saved

Please preview your submissions on a markdown reader

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter