Fei Protocol contest - ye0lde's results

Handle

ye0lde

Vulnerability details

Impact

"preMergeCirculatingTribe" can be made a constant to save gas.

Proof of Concept

preMergeCirculatingTribe is defined here: https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L28

And used here: https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L101

Tools Used

Visual Studio Code, Remix

Recommended Mitigation Steps

Change "preMergeCirculatingTribe" to a constant.

Handle

ye0lde

Vulnerability details

Impact

Gas savings and code clarity

Proof of Concept

Below are several occurrences of comparison with literal boolean values of true or false: https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/PegExchanger.sol#L37-L38 https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/PegExchanger.sol#L111

https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L64-L65 https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L69 https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L118

Tools Used

Visual Studio Code, Remix

Recommended Mitigation Steps

Use the compared expression itself in place of comparison with a boolean literal. The expression can be replaced as is when the expression is expected to evaluate to true and negation can be used when the expression is expected to have a false value.

Handle

ye0lde

Vulnerability details

Impact

State variables are being explicitly assigned their default value when defined which is unnecessary. Removing the assignment will save gas when deploying.

Proof of Concept

https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/PegExchanger.sol#L14-L15 https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/PegExchanger.sol#L22

https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L20 https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L22-L23 https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L26 https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L31 https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L40

Tools Used

Visual Studio Code, Remix

Recommended Mitigation Steps

Remove the assignments.

Or if you feel it is important to show the default assignment will occur then replace the assignments with a comment.

Handle

ye0lde

Vulnerability details

Impact

Gas savings and code clarity

Proof of Concept

The local variables on the lines below are declared to store the return values from requery yet some of these local variables are never used within the code.

https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L112-L113 https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L115

Tools Used

Visual Studio Code, Remix

Recommended Mitigation Steps

Change this: https://github.com/code-423n4/2021-11-fei/blob/add34324513b863f58e4ef7b3cd0c12d776dbb7f/contracts/TRIBERagequit.sol#L112-L115 to

		, //  pcv value 
		, // user fei
		int256 newProtocolEquity,
		  // validity
	) = oracle.pcvStats();