ElasticSwap contest - robee's results

Handle

robee

Vulnerability details

The following require messages are of length more than 32 and we think are short enough to short them into exactly 32 characters such that it will be placed in one slot of memory and the require function will cost less gas. The list:

    Solidity file: ExchangeFactory.sol, In line 44, Require message length to shorten: 33, The message: ExchangeFactory: IDENTICAL_TOKENS
    Solidity file: ExchangeFactory.sol, In line 49, Require message length to shorten: 35, The message: ExchangeFactory: DUPLICATE_EXCHANGE
    Solidity file: ExchangeFactory.sol, In line 73, Require message length to shorten: 36, The message: ExchangeFactory: INVAlID_FEE_ADDRESS
    Solidity file: MathLib.sol, In line 605, Require message length to shorten: 36, The message: MathLib: INSUFFICIENT_BASE_TOKEN_QTY
    Solidity file: MathLib.sol, In line 639, Require message length to shorten: 36, The message: MathLib: INSUFFICIENT_BASE_TOKEN_QTY

Handle

robee

Vulnerability details

   Using != 0 is slightly cheaper than > 0.
    see https://github.com/code-423n4/2021-12-maple-findings/issues/75 for similar issue.
    

    Exchange.sol, 178: change '_baseTokenQtyMin > 0' to '_baseTokenQtyMin != 0'
    Exchange.sol, 178: change '_quoteTokenQtyMin > 0' to '_quoteTokenQtyMin != 0'
    Exchange.sol, 267: change '_baseTokenQty > 0' to '_baseTokenQty != 0'
    Exchange.sol, 267: change '_minQuoteTokenQty > 0' to '_minQuoteTokenQty != 0'
    Exchange.sol, 304: change '_quoteTokenQty > 0' to '_quoteTokenQty != 0'
    Exchange.sol, 304: change '_minBaseTokenQty > 0' to '_minBaseTokenQty != 0'
    MathLib.sol, 125: change '_tokenAQty > 0' to '_tokenAQty != 0'
    MathLib.sol, 127: change '_tokenAReserveQty > 0' to '_tokenAReserveQty != 0'
    MathLib.sol, 127: change '_tokenBReserveQty > 0' to '_tokenBReserveQty != 0'
    MathLib.sol, 496: change '_baseTokenQtyDesired > 0' to '_baseTokenQtyDesired != 0'
    MathLib.sol, 500: change '_quoteTokenQtyDesired > 0' to '_quoteTokenQtyDesired != 0'
    MathLib.sol, 388: change '_totalSupplyOfLiquidityTokens > 0' to '_totalSupplyOfLiquidityTokens != 0'
    MathLib.sol, 606: change '_baseTokenReserveQty > 0' to '_baseTokenReserveQty != 0'
    MathLib.sol, 664: change '_baseTokenQty > 0' to '_baseTokenQty != 0'
    MathLib.sol, 664: change '_quoteTokenQtyMin > 0' to '_quoteTokenQtyMin != 0'

Handle

robee

Vulnerability details

Users can mistakenly think that the return value is the named return, but it is actually the actualreturn statement that comes after. To know that the user needs to read the code and is confusing. Furthermore, removing either the actual return or the named return will save gas.

    MathLib.sol, calculateAddQuoteTokenLiquidityQuantities
    MathLib.sol, calculateAddQuoteTokenLiquidityQuantities
    MathLib.sol, calculateAddBaseTokenLiquidityQuantities
    MathLib.sol, calculateAddBaseTokenLiquidityQuantities