Venus Protocol Isolated Pools - rapha's results

Earn, Borrow & Lend on the #1 Decentralized Money Market on the BNB Chain

General Information

Platform: Code4rena

Start Date: 08/05/2023

Pot Size: $90,500 USDC

Total HM: 17

Participants: 102

Period: 7 days

Judge: 0xean

Total Solo HM: 4

Id: 236

League: ETH

Venus Protocol

Findings Distribution

Researcher Performance

Rank: 97/102

Findings: 1

Award: $44.94

Gas:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

44.9387 USDC - $44.94

Labels

bug
G (Gas Optimization)
grade-b
G-24

External Links

Description

Calldata arrays are more gas efficient compared to memory arrays when passed as function arguments. That is true when the following conditions have been met:

  1. The function argument is read-only
  2. The function is not explicitly receiving a memory array.

The following files are affected:

File: contracts/Comptroller.sol
154:   function enterMarkets(address[] memory vTokens) external override returns (uint256[] memory) {

https://github.com/code-423n4/2023-05-venus/blob/9853f6f4fe906b635e214b22de9f627c6a17ba5b/contracts/Comptroller.sol#L154 This actually is in contrast to the extended ComptrollerInterface.sol which implements function enterMarkets(address[] calldata).

File: contracts/Rewards/RewardsDistributor.sol
197:    function setRewardTokenSpeeds(
198:        VToken[] memory vTokens,
199:        uint256[] memory supplySpeeds,
200:        uint256[] memory borrowSpeeds
201:    ) external {

https://github.com/code-423n4/2023-05-venus/blob/9853f6f4fe906b635e214b22de9f627c6a17ba5b/contracts/Rewards/RewardsDistributor.sol#L197

Impact

The total gas saved will amount to 952

Remediation

Change all the memory arrays received in the function arguments to calldata arrays:

File: contracts/Comptroller.sol
154:   function enterMarkets(address[] calldata vTokens) external override returns (uint256[] memory) {
File: contracts/Rewards/RewardsDistributor.sol
197:    function setRewardTokenSpeeds(
198:        VToken[] calldata vTokens,
199:        uint256[] calldata supplySpeeds,
200:        uint256[] calldata borrowSpeeds
201:    ) external {

#0 - c4-judge

2023-05-18T17:51:12Z

0xean marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter