Phuture Finance contest - rfa's results

Crypto index platform, that simplifies your investments through automated, themed index products.

General Information

Platform: Code4rena

Start Date: 19/04/2022

Pot Size: $30,000 USDC

Total HM: 10

Participants: 43

Period: 3 days

Judges: moose-code, JasoonS

Total Solo HM: 7

Id: 90

League: ETH

Phuture Finance

Findings Distribution

Researcher Performance

Rank: 36/43

Findings: 1

Award: $29.76

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

29.7589 USDC - $29.76

Labels

bug
G (Gas Optimization)

External Links

Gas

Title: Using < is less effective than !=

Occurence: https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ChainlinkPriceOracle.sol#L86 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/IndexLogic.sol#L76 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/IndexLogic.sol#L98

Instead of using > as operator for validate value is not zero, Using =! Is more effective for gas optimization.

Title: Using && is less effective than using multiple require()

Occurence: https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ChainlinkPriceOracle.sol#L86 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ChainlinkPriceOracle.sol#L86 Using && operator cost more execution gas fee. Use multiple require checks to save gas https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ManagedIndexReweightingLogic.sol#L29-L34

Change to:

require(basePrice > 0, "ChainlinkPriceOracle: NEGATIVE"); require(quotePrice > 0, "ChainlinkPriceOracle: NEGATIVE");

Title: Using custom error Occurence: https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/BaseIndex.sol#L29 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/BaseIndex.sol#L34 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ChainlinkPriceOracle.sol#L51 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ChainlinkPriceOracle.sol#L61-L62 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/IndexLogic.sol#L40 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/IndexLogic.sol#L76 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/IndexLogic.sol#L98 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ManagedIndexReweightingLogic.sol#L29-L34 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ManagedIndexReweightingLogic.sol#L52 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ManagedIndexReweightingLogic.sol#L58 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/PhuturePriceOracle.sol#L46-L47 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/TopNMarketCapIndex.sol#L55 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/TopNMarketCapReweightingLogic.sol#L67

Defined by using error statement, and using if(condition)revert() to check the condition. It can be implemented for all require() statement for gas opt.

Title: Using unchecked for ++i

https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/IndexLogic.sol#L60 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/IndexLogic.sol#L102 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/IndexLogic.sol#L125 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/ManagedIndex.sol#L30 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/TopNMarketCapIndex.sol#L48 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/TopNMarketCapReweightingLogic.sol#L51 https://github.com/code-423n4/2022-04-phuture/blob/main/contracts/TopNMarketCapReweightingLogic.sol#L37

Its almost impossible for i to overflow. Using unchecked can save execution gas cost Change to:

for (uint i; i < inactiveAssets.length(); ++i) { if (!IAccessControl(registry).hasRole(SKIPPED_ASSET_ROLE, inactiveAssets.at(i))) { uint lastBalanceInAsset = IvToken( IvTokenFactory(vTokenFactory).createOrReturnVTokenOf(inactiveAssets.at(i)) ).lastAssetBalanceOf(address(this)); lastAssetBalanceInBase += lastBalanceInAsset.mulDiv( FixedPoint112.Q112, oracle.refreshedAssetPerBaseInUQ(inactiveAssets.at(i)) ); } unchecked{++i} // @audit-info: Add here }
AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter