Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Gas Optimization Wrt. Token Uniqueness #160

Open
code423n4 opened this issue Sep 22, 2021 · 1 comment
Open

Gas Optimization Wrt. Token Uniqueness #160

code423n4 opened this issue Sep 22, 2021 · 1 comment
Labels
bug Warden finding G (Gas Optimization) sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")

Comments

@code423n4
Copy link
Contributor

Handle

leastwood

Vulnerability details

Impact

The validateWeights() function can be better optimised by using a hashmap to measure token uniqueness. Currently, the function utilises an O(n^2) solution. By first iterating through each hashmap index for _tokens, any previously set tokens can be first cleared . This improves the current solution to O(n).

Proof of Concept

https://github.com/code-423n4/2021-09-defiProtocol/blob/main/contracts/contracts/Basket.sol#L53-L70

Tools Used

Manual code review

Recommended Mitigation Steps

Consider using a hashmap to measure token uniqueness. However, this hashmap needs to first be cleared out before using it each time in validateWeights().

code423n4 added a commit that referenced this issue Sep 22, 2021
@frank-beard frank-beard added the sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity") label Nov 6, 2021
@GalloDaSballo
Copy link
Collaborator

Agree with the finding, and prefer the suggestion which keeps it fully trustless

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Warden finding G (Gas Optimization) sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")
Projects
None yet
Development

No branches or pull requests

3 participants