OpenLeverage contest - rfa's results

Handle

rfa

Vulnerability details

Impact

expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/bsc/BscDexAggregatorV1.sol#L44 all the parameter pointer (memory) can replaced by calldata

Handle

rfa

Vulnerability details

Impact

expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L53 1 second difference can be ignored to validate distributions[stakeToken].starttime. using > operator can save gas

Tools Used

manual review

Recommended Mitigation Steps

require(block.timestamp > distributions[stakeToken].starttime, "not start");

Handle

rfa

Vulnerability details

Impact

expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/XOLE.sol#L93 instead of using toShare to store oleToken.balanceOf(address(this)).sub(claimable).sub(totalLocked).sub(devFund);. Just use newReward directly to save more gas.

Tools Used

Recommended Mitigation Steps

uint newReward;
        if (fromToken == address(oleToken)) {
            uint claimable = totalRewarded.sub(withdrewReward);
            newReward= oleToken.balanceOf(address(this)).sub(claimable).sub(totalLocked).sub(devFund);
            require(newReward >= amount, 'Exceed OLE balance');

Handle

rfa

Vulnerability details

Impact

expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/eth/EthDexAggregatorV1.sol#L151-L158 better use require() here

Tools Used

Recommended Mitigation Steps

    function calSellAmount(address buyToken, address sellToken, uint24 buyTax, uint24 sellTax, uint buyAmount, bytes memory data) external view override returns (uint sellAmount){
        require(data.isUniV2Class(), 'Unsupported dex'); 
            sellAmount = uniV2CalSellAmount(dexInfo[data.toDex()], buyToken, sellToken, buyAmount, buyTax, sellTax);
    }

Handle

rfa

Vulnerability details

Impact

expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/bsc/BscDexAggregatorV1.sol#L35

Tools Used

Recommended Mitigation Steps

remove _unsedFactory;

Handle

rfa

Vulnerability details

Impact

expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/bsc/BscDexAggregatorV1.sol#L22 we can set the pancakeFacory address directly at line 22. then use constant. (the address has already exist at: https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/bsc/BscDexAggregatorV1.sol#L28 )

Handle

rfa

Vulnerability details

Impact

expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/bsc/BscDexAggregatorV1.sol#L47

Recommended Mitigation Steps

replace the 2 lines of code by just 1 line:

dexInfo[dexName[i]] = DexInfo(factoryAddr[i], fees[i]);

Handle

rfa

Vulnerability details

Impact

expensive gas usage

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage- contracts/contracts/dex/bsc/UniV2ClassDex.sol#L15

The implementation of Utils library on BscDexAggregatorV1.sol contract is more gas efficient(remove line 15 on UniV2ClassDex.sol)

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/bsc/BscDexAggregatorV1.sol

Handle

rfa

Vulnerability details

Impact

expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/bsc/BscDexAggregatorV1.sol#L183 instead of caching V2PriceOracle. just readit directly to the storage. (use storage as pointer instead of memory)

Recommended Mitigation Steps

        V2PriceOracle storage priceOracle = uniV2PriceOracle[IUniswapV2Pair(pair)];

Handle

rfa

Vulnerability details

Impact

expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/eth/EthDexAggregatorV1.sol#L71-L76 its unnecessary to store msg.sender in the payer. Just pass msg.sender as an argument on buyAmount

Recommended Mitigation Steps

remove line 71

Handle

rfa

Vulnerability details

Impact

expensive gas

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/bsc/BscDexAggregatorV1.sol#L45 && operatoris using more gas than just using multiple require()

Recommended Mitigation Steps

require(dexName.length == factoryAddr.length, 'EOR');
require(dexName.length == fees.length, 'EOR');