Joyn contest - securerodd's results

JOYN Contest

April 1, 2022

@securerodd

Findings

Low Risk Findings

1. Initializer Can be Reinitialized

The initializer function in CoreCollection.sol does not contain the onlyUnInitialized() modifier.

Code:

function initialize(
    string memory _collectionName,
    string memory _collectionSymbol,
    string memory _collectionURI,
    uint256 _maxSupply,
    uint256 _mintFee,
    address _payableToken,
    bool _isForSale,
    address _splitFactory
    ) external onlyOwner onlyValidSupply(_maxSupply) {
        _name = _collectionName;
        _symbol = _collectionSymbol;
        _baseUri = _collectionURI;
        maxSupply = _maxSupply;
        mintFee = _mintFee;
        payableToken = IERC20(_payableToken);
        isForSale = _isForSale;
        splitFactory = _splitFactory;
        initialized = true;
    }

The onlyUnInitialized() modifier is currently unused in the code base. In CoreFactory.sol, Core Collections are deployed by an EOA or contract interacting with the Core Factory itself. Without the modifier, these owners have the ability to completely reconfigure key aspects of the collection.

Recommendation:

Apply the onlyUnInitialized() modifier to the initializer function in CoreCollection.sol.

JOYN Contest

April 1, 2022

@securerodd

Gas Optimizations

1. For Loop Improvements through Local Variable Caching and Prefix Increment

The for loop in createProject(string memory _projectId, Collection[] memory _collections) within CoreFactory.sol performs a length check and postfix increment at each iteration. The code can be seen below:

require(
    _collections.length > 0,
    'CoreFactory: should have more at least one collection'
);

    for (uint256 i; i < _collections.length; i++) {
    ...
    }

This can be improved by storing the collections length in a local variable in memory and using a prefix increment instead.

Recommended logic:

uint collLength = _collections.length;
require(
    collLength > 0,
    'CoreFactory: should have more at least one collection'
);

    for (uint256 i; i < collLength; ++i) {
    ...
    }

Output of provided tests can be seen below. The gas savings would be greater for projects with larger collections.

Existing logic:

__________________________________________________________________________________________________
| Contract          ·  Method              ·  Min        ·  Max        ·  Avg         ·  # calls |    
__________________________________________________________________________________________________
| CoreFactory       ·  createProject       ·  463683     ·  878840     ·  602069      ·     6    |
__________________________________________________________________________________________________

Recommened logic:

__________________________________________________________________________________________________
| Contract          ·  Method              ·  Min        ·  Max        ·  Avg         ·  # calls |    
__________________________________________________________________________________________________
| CoreFactory       ·  createProject       ·  463671     ·  878820     ·  602054      ·     6    |
__________________________________________________________________________________________________