Tempus Finance contest - pants's results

Handle

pants

Vulnerability details

These files has open TODOs:

• TempusPool.sol
• unusedAMMImportOnly.sol
• Fixed256xVar.sol
• LidoTempusPool.sol

Impact

Open TODOs can hint at programming or architectural errors that still need to be fixed.

Tool Used

Manual code review.

Recommended Mitigation Steps

Resolve these TODOs and bubble up the errors.

Handle

pants

Vulnerability details

There are many for loops that follows this for-each pattern:

for (uint256 i = 0; i < array.length; i++) {
	// do something with `array[i]`
}

In such for loops, the array.length is read on every iteration, instead of caching it once in a local variable and read it again using the local variable.

Impact

Memory reads are a bit more expensive than reading local variables.

Tool Used

Manual code review.

Recommended Mitigation Steps

Read these values from memory once, cache them in local variables and then read them again using the local variables. For example:

uint256 length = array.length;
for (uint256 i = 0; i < length; i++) {
	// do something with `array[i]`
}

Handle

pants

Vulnerability details

These functions use prefix increaments (x++) instead of postfix increaments (++x):

• TempusAMM.getSwapAmountToEndWithEqualShares()
• ComptrollerMock.enterMarkets()
• ComptrollerMock.exitMarket()

Impact

Prefix increaments are cheaper than postfix increaments.

Tool Used

Manual code review.

Recommended Mitigation Steps

Change all prefix increaments to postfix increaments where it doesn't affects the functionality.

Handle

pants

Vulnerability details

These public functions are never called by their contract:

• TempusAMM.getSwapAmountToEndWithEqualShares()
• TempusAMM.getRate()
• AaveTempusPool.currentInterestRate()
• AaveTempusPool.numAssetsPerYieldToken()
• AaveTempusPool.numYieldTokensPerAsset()
• CompoundTempusPool.currentInterestRate()
• CompoundTempusPool.numAssetsPerYieldToken()
• CompoundTempusPool.numYieldTokensPerAsset()
• LidoTempusPool.currentInterestRate()
• LidoTempusPool.numAssetsPerYieldToken()
• LidoTempusPool.numYieldTokensPerAsset()
• ERC20FixedSupply.decimals()
• ERC20OwnerMintableToken.burn()
• ERC20OwnerMintableToken.burnFrom()
• PoolShare.decimals()
• PermanentlyOwnable.renounceOwnership()
• TempusController.depositYieldBearing()
• TempusController.depositBacking()
• TempusController.redeemToYieldBearing()
• TempusController.redeemToBacking()
• TempusPool.estimatedMintedShares()
• TempusPool.estimatedRedeem()

Therefore, their visibility can be reduced to external.

Impact

external functions are cheaper than public functions.

Proof of Concept

https://gus-tavo-guim.medium.com/public-vs-external-functions-in-solidity-b46bcf0ba3ac

Tool Used

Manual code review.

Recommended Mitigation Steps

Define these functions as external.