search

code-423n4 / 2021-09-defiprotocol-findings

1 stars 0 forks source link

Transfer tokens directly to the basket #92

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

itsmeSTYJ

Vulnerability details

Impact

Gas optimisation

Proof of concept

You can save some gas when it comes to creating a new basket by transferring the tokens directly to the newly created Basket contract instead of transferring to the factory, approving the basket and then calling transferFrom to move the tokens to the basket.

Recommended Mitigation Steps

You need to have a separate mintTo function that can only be called by the Factory and doesn't contain the pullUnderlying(amount, msg.sender) function.

frank-beard commented 3 years ago

while this could work, we prefer to not add special functions for situations like that

GalloDaSballo commented 2 years ago

Agree with the finding, and in contract to another warden's submission, there's a clear example of the logic and what it should do.

No problem for it being a nofix, but the finding is valid