Yield Witch v2 contest - samruna's results

Fixed-rate borrowing and lending on Ethereum

General Information

Platform: Code4rena

Start Date: 14/07/2022

Pot Size: $25,000 USDC

Total HM: 2

Participants: 63

Period: 3 days

Judge: PierrickGT

Total Solo HM: 1

Id: 147

League: ETH

Yield

Findings Distribution

Researcher Performance

Rank: 49/63

Findings: 1

Award: $17.37

🌟 Selected for report: 0

🚀 Solo Findings: 0

  1. Use of custom errors instead of require

Starting from Solidity v0.8.4, there is a convenient and gas-efficient way to explain to users why an operation failed through the use of custom errors. Until now, you could already use strings to give more information about failures (e.g., revert("Insufficient funds.");), but they are rather expensive, especially when it comes to deploy cost, and it is difficult to use dynamic information in them.

Code: https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L84 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L102-108 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L189 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L200 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L255-256 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L300 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L313 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L328 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L358 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L365 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L395 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L416 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L437

Mitigation: Define customer ERROR() and replace require with, `` if (a != b) revert ERROR()

``

  1. Integer check with != It's better to use != 0 operators with integer data types. This is much cheaper than > 0

Code: https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L255-256 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L300 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L358 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L393-398 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L416

  1. Use constants Code: https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L63

The above variable can be defined as constant and immutable for gas consumption

  1. Define constants for numbers

Code: https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L102-108 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L162-163 https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L587-591

In the above code, a hard number value (1e18) is used. It's better to define a global immutable constant and reference it in the code. It improved code readability and saves gas.

  1. Storage variable can be deleted if validation fails

Code: https://github.com/code-423n4/2022-07-yield/blob/main/contracts/Witch.sol#L254

In the above code, the storage variable auction_ can be deleted if the next 2 require() statement fails. This will save some unused gas.

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter