Nested Finance contest - pmerkleplant's results

Handle

pmerkleplant

Vulnerability details

Impact

The function removeOperator in NestedFacotry.sol requires that the operator to remove has an index greater than 0, see line 84.

This disabled the functionality of removing the operator at index 0, i.e. the first added operator.

Recommended Mitigation Steps

Remove the require statement.

Handle

pmerkleplant

Vulnerability details

Impact

Function getAmountDue in FeeSplitter.sol defines the variable totalReceived in line 83 eventhough it is already known if the variable is even necessary.

The variable is uneccessary if _tokenRecords.totalShares == 0. Not declaring it, if not necessary, saves gas.

Recommended Mitigation Steps

Rewrite the function to something like:

TokenRecords storage _tokenRecords = tokenRecords[address(_token)];
if (_tokenRecords.totalShares == 0) return 0;
uint256 totalReceived = _tokenRecords.totalReleased + _token.balanceOf(address(this));
// Rest same as before

Handle

pmerkleplant

Vulnerability details

Function triggerForToken in NestedBuybacker.sol makes a balanceOf call on the _sellToken, see line 100.

However, the result of the call is never used.

It would save gas to remove the unnecessary call and variable declaration.

Handle

pmerkleplant

Vulnerability details

Function _submitOrder in NestedFactory.sol saves two return values of a call in variables, see line 379.

However, the variable tokens is never used, and removing it would save gas.