TwapOracle.sol update() Multiple SLOAD During Loop

[code423n4]

Handle

Meta0xNull

Vulnerability details

Impact

Repeat SLOAD _pairs during the loop
Save _pairs as pairData in Storage in loop
Multiple SLOAD pairData within same loop

Storage SLOAD are more expensive than read local variables. The Gas Price Add Up during Loop is very very expensive.

Proof of Concept

https://github.com/code-423n4/2021-11-vader/blob/main/contracts/twap/TwapOracle.sol#L322-L368

Tools Used

Manual Review

Recommended Mitigation Steps

Before the Loop Start, SLOAD _pairs and caching it once in a local variable _pairs_temp. Then use local variable _pairs_temp in the loop.

PairData _pairs_temp = _pairs;

[SamSteinGG]

Duplicate of #94

[alcueca]

Not a duplicate of #94

[SamSteinGG]

The TWAP oracle module has been completely removed and redesigned from scratch as LBTwap that is subject of the new audit.