Slingshot Finance contest - ye0lde's results

Handle

ye0lde

Vulnerability details

Impact

The comments above rescueTokensFromExecutioner were probably copied over from rescueTokens. They should be modified to refer to rescueTokensFromExecutioner.

Proof of Concept

https://github.com/code-423n4/2021-10-slingshot/blob/9c0432cca2e43731d5a0ae9c151dacf7835b8719/contracts/Slingshot.sol#L130-L131

Tools Used

Visual Studio Code, Remix

Recommended Mitigation Steps

Correct the comments

Handle

ye0lde

Vulnerability details

Impact

Shortening revert strings to fit in 32 bytes will decrease deployment time gas and will decrease runtime gas when the revert condition has been met.

Revert strings that are longer than 32 bytes require at least one additional mstore, along with additional overhead for computing memory offset, etc.

Proof of Concept

Revert strings > 32 bytes are here: https://github.com/code-423n4/2021-10-slingshot/blob/9c0432cca2e43731d5a0ae9c151dacf7835b8719/contracts/Adminable.sol#L14 https://github.com/code-423n4/2021-10-slingshot/blob/9c0432cca2e43731d5a0ae9c151dacf7835b8719/contracts/ApprovalHandler.sol#L15 https://github.com/code-423n4/2021-10-slingshot/blob/9c0432cca2e43731d5a0ae9c151dacf7835b8719/contracts/Executioner.sol#L64 https://github.com/code-423n4/2021-10-slingshot/blob/9c0432cca2e43731d5a0ae9c151dacf7835b8719/contracts/Slingshot.sol#L74-L75 https://github.com/code-423n4/2021-10-slingshot/blob/9c0432cca2e43731d5a0ae9c151dacf7835b8719/contracts/Slingshot.sol#L93 https://github.com/code-423n4/2021-10-slingshot/blob/9c0432cca2e43731d5a0ae9c151dacf7835b8719/contracts/module/IUniswapModule.sol#L28

Tools Used

Visual Studio Code

Recommended Mitigation Steps

Shorten the revert strings to fit in 32 bytes.

Or consider using Custom Errors.

Handle

ye0lde

Vulnerability details

Impact

Removing unused named return variables can reduce gas usage and improve code clarity. Even pure functions still cost gas if they are called internally from another function like at least two of the functions below.

Proof of Concept

https://github.com/code-423n4/2021-10-slingshot/blob/9c0432cca2e43731d5a0ae9c151dacf7835b8719/contracts/lib/ConcatStrings.sol#L15 https://github.com/code-423n4/2021-10-slingshot/blob/9c0432cca2e43731d5a0ae9c151dacf7835b8719/contracts/lib/ConcatStrings.sol#L23 https://github.com/code-423n4/2021-10-slingshot/blob/9c0432cca2e43731d5a0ae9c151dacf7835b8719/contracts/lib/ConcatStrings.sol#L31

Tools Used

Visual Studio Code, Remix

Recommended Mitigation Steps

Remove the unused named returns