Tempus Finance contest - pauliax's results

Handle

pauliax

Vulnerability details

Impact

Lower than uint256 size storage variables are less gas efficient. E.g. using uint8 does not give any efficiency, actually, it is the opposite as EVM operates on default of 256-bit values so uint8 is more expensive in this case as it needs a conversion. It only gives improvements in cases where you can pack variables together, e.g. structs. An example where uint8 does not give any performance boost: for (uint8 i = 0; i < 32; i++)

Recommended Mitigation Steps

Consider using optimal uint256 values.

Handle

pauliax

Vulnerability details

Impact

There are unused imports. They will increase the size of deployment with no real benefit. Consider removing unused imports to save some gas. Examples of such imports are:

In TempusAMMUserDataHelpers import "@balancer-labs/v2-solidity-utils/contracts/openzeppelin/IERC20.sol";

In TempusController import "@openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol";

In TempusAMM import "@balancer-labs/v2-solidity-utils/contracts/helpers/WordCodec.sol";

Recommended Mitigation Steps

Consider removing them to reduce deployment gas usage.

Handle

pauliax

Vulnerability details

Impact

The loop here is not really necessary as _TOTAL_TOKENS is a constant of 2 so there is always just 1 iteration: for (uint256 i = 1; i < _TOTAL_TOKENS; ++i) { uint256 currentBalance = balances[i]; if (currentBalance > maxBalance) { chosenTokenIndex = i; maxBalance = currentBalance; } }

Recommended Mitigation Steps

Consider if you want to reduce gas usage by eliminating this loop here but taking the risk that _TOTAL_TOKENS will not be updated to a different value.

Handle

pauliax

Vulnerability details

Impact

Using the unchecked keyword to avoid redundant arithmetic underflow/overflow checks to save gas when an underflow/overflow cannot happen. E.g. 'unchecked' can be applied in the following lines of code since there are require statements before to ensure the arithmetic operations would not cause an integer underflow or overflow:

require(underlyingDecimals <= 18, "underlying decimals must be <= 18"); exchangeRateToBackingPrecision = 10**(18 - underlyingDecimals);

or if (sharesUsed[0] < mintedShares) { ammTokens[0].safeTransfer(msg.sender, mintedShares - sharesUsed[0]); } if (sharesUsed[1] < mintedShares) { ammTokens[1].safeTransfer(msg.sender, mintedShares - sharesUsed[1]); }

Recommended Mitigation Steps

Consider if you want to apply this keyword and then carefully select where it is safe to do this.