search

code-423n4 / 2021-09-yaxis-findings

0 stars 0 forks source link

Gas: Unnecessary addition in `Vault.deposit` #118

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

The Vault.deposit function performs an unnecessary add here as _shares is always zero at this point:

if (_amount > 0) {
    _amount = _normalizeDecimals(_token, _amount);

    if (totalSupply() > 0) {
        _amount = (_amount.mul(totalSupply())).div(_balance);
    }
    // @audit gas: just set _shares = _amount, no .add needed
    _shares = _shares.add(_amount);
}

Recommended Mitigation Steps

Set _shares = _amount directly instead of adding amount to the always zero-valued _shares.

Haz077 commented 3 years ago

Same as #6

GalloDaSballo commented 2 years ago

Agree with finding, sponsor mitigated, see progress in #116