Biconomy - Smart Contract Wallet contest - pavankv's results

One-Stop solution to enable an effortless experience in your dApp to onboard new users and abstract away transaction complexities.

General Information

Platform: Code4rena

Start Date: 04/01/2023

Pot Size: $60,500 USDC

Total HM: 15

Participants: 105

Period: 5 days

Judge: gzeon

Total Solo HM: 1

Id: 200

League: ETH

Biconomy

Findings Distribution

Researcher Performance

Rank: 71/105

Findings: 1

Award: $38.76

Gas:

grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository Biconomy

Findings Information

🌟 Selected for report: 0xSmartContract

Also found by: 0x1f8b, 0xhacksmithh, Aymen0909, Bnke0x0, IllIllI, Rageur, RaymondFam, Rickard, Rolezn, Secureverse, arialblack14, chaduke, chrisdior4, cthulhu_cult, giovannidisiena, gz627, lukris02, oyc_109, pavankv, privateconstant, shark

Awards

38.7634 USDC - $38.76

Labels

bug

G (Gas Optimization)

grade-b

judge review requested

sponsor confirmed

edited-by-warden

G-21

External Links

Link to GitHub issue

1.Reduce the size of error messages (Long revert Strings).

Shortening revert strings to fit in 32 bytes will decrease deployment time gas and will decrease runtime gas when the revert condition is met. Revert strings that are longer than 32 bytes require at least one additional mstore, along with additional overhead for computing memory offset, etc.

2 .Use named returns for local variables where it is possible to save gas :-

code snippet:- https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L140

recommendation :- Declare varaible in return only

3 .Splitting require() statements that use && saves gas

See this issue which describes the fact that there is a larger deployment gas cost, but with enough runtime calls, the change ends up being cheaper by 3 gas because && opcode use 3 gas .

code snippet:- https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/base/ModuleManager.sol#L34 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/base/ModuleManager.sol#L49 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/base/ModuleManager.sol#L68

Recommendation :- use two require instead of &&

4 .Bitshift for divide by 2

When multiply or dividing by a power of two, it is cheaper to bitshift than to use standard math operations. code snippet:- https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/libs/Math.sol#L36

reference :- https://code4rena.com/reports/2022-04-xtribe/#g-06-bitshift-for-divide-by-2

Recommended Mitigation Steps:- Bitshift right by one bit instead of dividing by 2 to save gas like use >>1 .

5 .Increments/decrements can be unchecked in for-loops

In Solidity 0.8+, there’s a default overflow check on unsigned integers. It’s possible to uncheck this in for-loops and save some gas at each iteration, but at the cost of some code readability, as this uncheck cannot be made inline.

code snippet:- https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/aa-4337/core/EntryPoint.sol#L100 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/aa-4337/core/EntryPoint.sol#L107 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/aa-4337/core/EntryPoint.sol#L112

6 .storage pointer to a structure is cheaper than copying each value of the structure into memory, same for array and mapping

It may not be obvious, but every time you copy a storage struct/array/mapping to a memory variable, you are copying each member by reading it from storage, which is expensive. And when you use the storage keyword, you are just storing a pointer to the storage, which is much cheaper. Exception: case when you need to read all or many members multiple times. In report included only cases that saved gas

code snippet:- https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/aa-4337/core/EntryPoint.sol#L171 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/aa-4337/core/EntryPoint.sol#L229 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/aa-4337/core/EntryPoint.sol#L293 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/aa-4337/core/EntryPoint.sol#L351

Reference :- https://code4rena.com/reports/2022-09-nouns-builder/#g-01-storage-pointer-to-a-structure-is-cheaper-than-copying-each-value-of-the-structure-into-memory-same-for-array-and-mapping-5-instances

7 .Expressions that cannot be overflowed can be unchecked :-

code snippet:-

https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/aa-4337/core/EntryPoint.sol#L233

8 Using Solidity version 0.8.17 will provide an overall gas optimization

Using at least 0.8.10 will save gas due to skipped extcodesize check if there is a return value. Currently the contracts are compiled using version 0.8.7 (Foundry default). It is easily changeable to 0.8.17 using the command sed -i 's/0.8.7/^0.8.0/' test/*.sol && sed -i '4isolc = "0.8.17"' foundry.toml. This will have the following total savings obtained by forge snapshot --diff | tail -1

code snippet:- https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L2 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/aa-4337/core/EntryPoint.sol#L2 And all Scoped files .

9 Functions guaranteed to revert when called by normal users can be marked payable

If a function modifier such as onlyOwner is used, the function will revert if a normal user tries to pay the function. Marking the function as payable will lower the gas cost for legitimate callers because the compiler will not include checks for whether a payment was provided. The extra opcodes avoided are CALLVALUE(2),DUP1(3),ISZERO(3),PUSH2(3),JUMPI(10),PUSH1(3),DUP1(3),REVERT(0),JUMPDEST(1),POP(2), which costs an average of about 21 gas per call to the function, in addition to the extra deployment cost

code snippet:- https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L449 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L445 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L460 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L465 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/SmartAccount.sol#L489 https://github.com/code-423n4/2023-01-biconomy/blob/main/scw-contracts/contracts/smart-contract-wallet/paymasters/BasePaymaster.sol#L99

#0 - c4-judge
2023-01-22T16:02:47Z

gzeon-c4 marked the issue as grade-b

#1 - livingrockrises
2023-01-24T07:25:07Z

storage pointer to a structure is cheaper than copying each value of the structure into memory, same for array and mapping

^ It's not valid in this case as it actually uses variable from function parameter and not directly access the storage variable in any case.

#2 - c4-sponsor
2023-01-24T07:31:15Z

livingrockrises marked the issue as sponsor confirmed

#3 - livingrockrises
2023-01-24T07:31:33Z

overall satisfactory.

#4 - c4-sponsor
2023-01-24T07:31:42Z

livingrockrises requested judge review

Biconomy - Smart Contract Wallet contest - pavankv's results

One-Stop solution to enable an effortless experience in your dApp to onboard new users and abstract away transaction complexities.

General Information

Findings Distribution

Researcher Performance

External Links

[G-21] Gas Report - $38.76

Findings Information

Awards

Labels

External Links

1.Reduce the size of error messages (Long revert Strings).

2 .Use named returns for local variables where it is possible to save gas :-

3 .Splitting require() statements that use && saves gas

4 .Bitshift for divide by 2

5 .Increments/decrements can be unchecked in for-loops

6 .storage pointer to a structure is cheaper than copying each value of the structure into memory, same for array and mapping

7 .Expressions that cannot be overflowed can be unchecked :-

8 Using Solidity version 0.8.17 will provide an overall gas optimization

9 Functions guaranteed to revert when called by normal users can be marked payable

#0 - c4-judge2023-01-22T16:02:47Z

#1 - livingrockrises2023-01-24T07:25:07Z

#2 - c4-sponsor2023-01-24T07:31:15Z

#3 - livingrockrises2023-01-24T07:31:33Z

#4 - c4-sponsor2023-01-24T07:31:42Z

#0 - c4-judge
2023-01-22T16:02:47Z

#1 - livingrockrises
2023-01-24T07:25:07Z

#2 - c4-sponsor
2023-01-24T07:31:15Z

#3 - livingrockrises
2023-01-24T07:31:33Z

#4 - c4-sponsor
2023-01-24T07:31:42Z