OpenLeverage contest - sirhashalot's results

Handle

sirhashalot

Vulnerability details

Impact

Many ERC20 tokens use the OpenZeppelin ERC20 library. The OLEToken.sol contract does not. The OpenZeppelin ERC20 library includes the non-standard increaseAllowance and decreaseAllowance functions to mitigate the allowance double spend issue that exists if these functions are not available. While this frontrunning attack vector is not the most common, removing a solution to the problem means users have no good options to prevent against this risk.

Proof of Concept

The OLEToken.sol ERC20 contract only implements the minimum requirements for an ERC20 token. It does not implement the non-standard increaseAllowance and decreaseAllowance functions which provide a safer way to adjusting a user's allowance.

Recommended Mitigation Steps

Add the non-standard increaseAllowance and decreaseAllowance functions from the OpenZeppelin ERC20 library to OLEToken.sol to mitigate the allowance double spend issue

Handle

sirhashalot

Vulnerability details

Impact

The liquidateAllowed() function in ControllerV1.sol contract two input parameters that are not used. These could be removed to save gas.

Proof of Concept

The liquidateAmount and dexData variables are unused input parameters and could be removed.

Recommended Mitigation Steps

Remove unused function input parameters for gas savings.

Handle

sirhashalot

Vulnerability details

Impact

Strings are broken into 32 byte chunks for operations. Revert error strings over 32 bytes therefore consume extra gas as documented publicly

Proof of Concept

There are multiple examples of this gas optimization opportunity, including but not limited to:

• XOLE.sol lines 254, 268
• liquidity/LPool.sol line 57
• gov/GovernorAlpha.sol lines 225, 272, 277

Recommended Mitigation Steps

Reducing revert error strings to under 32 bytes decreases deployment time gas and runtime gas when the revert condition is met. Alternatively, the code could be modified to use custom errors, introduced in Solidity 0.8.4: https://blog.soliditylang.org/2021/04/21/custom-errors/