Streaming Protocol contest - pedroais's results

Handle

pedroais

Vulnerability details

Proof of Concept

The function update stream internal uses an address "who" as input but it's never used inside the function.

Handle

pedroais

Vulnerability details

Impact

Public functions that aren't used inside the contract can be declared external to save gas

Handle

pedroais

Vulnerability details

Impact

!= 0 is a cheaper operation compared to > 0, when dealing with uint.

Occurences

Streaming/src/Locke.sol: 226: if (acctTimeDelta > 0 && ts.tokens > 0) { Streaming/src/Locke.sol: 236: if (tdelta > 0 && unstreamed > 0) { Streaming/src/Locke.sol: 378: require(amount > 0, "amt"); Streaming/src/Locke.sol: 418: require(amount > 0, "amt"); Streaming/src/Locke.sol: 456: require(amount > 0, "amt"); Streaming/src/Locke.sol: 522: require(amount > 0, "amt"); Streaming/src/Locke.sol: 572: require(rewardAmt > 0, "amt"); Streaming/src/Locke.sol: 612: if (fees > 0) { Streaming/src/Locke.sol: 226: if (fees > 0) { Streaming/src/Locke.sol: 612: if (incentives[token] > 0) { Streaming/src/Locke.sol: 679: if (acctTimeDelta > 0 && ts.tokens > 0) {

Handle

pedroais

Vulnerability details

Impact

Useless checks that cost gas

Proof of Concept

Since the Flashloan function has the lock modifier reentrancy is not possible so checking both tokens is useless.

Recommended Mitigation Steps

Proposed new function with less code :

        function flashloan(address token, address to, uint112 amount, bytes memory data) public lock {
    require(token == depositToken || token == rewardToken, "erc");

    uint256 preTokenBalance = ERC20(token).balanceOf(address(this));

    ERC20(token).safeTransfer(to, amount);

    // the `to` contract should have a public function with the signature:
    // function lockeCall(address initiator, address token, uint256 amount, bytes memory data);
    LockeCallee(to).lockeCall(msg.sender, token, amount, data);

    uint256 postTokenBalance = ERC20(token).balanceOf(address(this));

    uint112 feeAmt = amount * 10 / 10000; // 10bps fee
    require(preTokenBalance + feeAmt <= postTokenBalance, "f1");

    if (token == depositToken) {
        depositTokenFlashloanFeeAmount += feeAmt;
    } else {
        rewardTokenFeeAmount += feeAmt;
    }

    emit Flashloaned(token, msg.sender, amount, feeAmt);
}

Handle

pedroais

Vulnerability details

Impact

Save gas