Biconomy Hyphen 2.0 contest - z3s's results

Next-Gen Multichain Relayer Protocol.

General Information

Platform: Code4rena

Start Date: 10/03/2022

Pot Size: $75,000 USDT

Total HM: 25

Participants: 54

Period: 7 days

Judge: pauliax

Total Solo HM: 10

Id: 97

League: ETH

Biconomy

Findings Distribution

Researcher Performance

Rank: 40/54

Findings: 2

Award: $181.96

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

119.0712 USDT - $119.07

Labels

bug
QA (Quality Assurance)

External Links

Non Critical

Use newer compiler version:

It's a best practice to use the latest compiler version. The specified compiler version (0.8.0) is quite old. Older compilers might be susceptible to some bugs.

A list of known compiler bugs and their severity can be found here: https://etherscan.io/solcbuginfo

Code Style: removing unused named return variables can improve code clarity:

Remove the unused named return variables. https://github.com/code-423n4/2022-03-biconomy/blob/main/contracts/hyphen/token/TokenManager.sol#L139

Code Style: redundant leading space in require message and all uppecase message:

https://github.com/code-423n4/2022-03-biconomy/blob/main/contracts/hyphen/token/TokenManager.sol#L76

require message has a redundant leading space. and it's casing is different from other messages.

Awards

62.8947 USDT - $62.89

Labels

bug
G (Gas Optimization)

External Links

Gas Optimizations

Save 2 SLOADs in changeFee():

At https://github.com/code-423n4/2022-03-biconomy/blob/main/contracts/hyphen/token/TokenManager.sol#L53

reuse args instead of state vars:

change this:

emit FeeChanged(tokenAddress, tokensInfo[tokenAddress].equilibriumFee, tokensInfo[tokenAddress].maxFee);

to this:

emit FeeChanged(tokenAddress, _equilibriumFee, _maxFee);

Use calldata instead of memory in setDepositConfig():

https://github.com/code-423n4/2022-03-biconomy/blob/main/contracts/hyphen/token/TokenManager.sol#L69

For external function's dynamic params, calldata is the cheapest location to use.

Change params memory to calldata

Long require message:

use under 32 bytes strings. The following could be refactored:

Using newer compiler versions gives gas optimizations:

For example:

  • Low level inliner: from 0.8.2, leads to cheaper runtime gas. Especially relevant when the contract has small functions. For example, OpenZeppelin libraries typically have a lot of small helper functions and if they are not inlined, they cost an additional 20 to 40 gas because of 2 extra jump instructions and additional stack operations needed for function calls.
  • Optimizer improvements in packed structs: Before 0.8.3, storing packed structs, in some cases used an additional storage read operation. After EIP-2929, if the slot was already cold, this means unnecessary stack operations and extra deploy time costs. However, if the slot was already warm, this means additional cost of 100 gas alongside the same unnecessary stack operations and extra deploy time costs.
  • Custom errors from 0.8.4, leads to cheaper deploy time cost and run time cost. Note: the run time cost is only relevant when the revert condition is met. In short, replace revert strings by custom errors.

Upgrade pragma to at least version 0.8.4

Removing unused named return variables gives gas optimizations:

https://github.com/code-423n4/2022-03-biconomy/blob/main/contracts/hyphen/token/TokenManager.sol#L139

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter