OpenLeverage contest - p4st13r4's results

Handle

p4st13r4

Vulnerability details

Impact

In constructor of OLETokenLock.sol , the variable i is incremented using i++. It is known that using ++i costs less gas per iteration than i++.

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/OLETokenLock.sol#L33

Tools Used

Editor

Recommended Mitigation Steps

Replace i++ with ++i

Handle

p4st13r4

Vulnerability details

Impact

Timelock.sol has two functions that emit an event using a variable read from storage, while they could re-use an already declared local variable to achieve the same result

Proof of Concept

• https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/gov/Timelock.sol#L56
• https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/gov/Timelock.sol#L75

Tools Used

Editor

Recommended Mitigation Steps

function setDelay(uint delay_) public {
    require(msg.sender == address(this), "Call must come from Timelock");
    require(delay_ >= MINIMUM_DELAY, "Delay must exceed minimum");
    require(delay_ <= MAXIMUM_DELAY, "Delay must not exceed maximum");
    delay = delay_;

    emit NewDelay(delay_);
}

function setPendingAdmin(address pendingAdmin_) public {
    if (admin_initialized) {
        require(msg.sender == address(this), "Call must come from Timelock");
    } else {
        require(msg.sender == admin, "Call must come from admin");
        admin_initialized = true;
    }
    pendingAdmin = pendingAdmin_;
    emit NewPendingAdmin(pendingAdmin_);
}