code-423n4 / 2021-11-nested-findings

1 stars 1 forks source link

Save storage NestedRecords.records.reserve address variable to memory #225

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

hyh

Vulnerability details

Impact

Storage accessed more than needed, increasing gas costs.

Proof of Concept

records[_nftId].reserve is accessed several times.

https://github.com/code-423n4/2021-11-nested/blob/main/contracts/NestedRecords.sol#L61

Recommended Mitigation Steps

Add memory variable and use it in the logic:

address memory nft_reserve = records[_nftId].reserve;

Do reserve update only if needed: Now:

records[_nftId].reserve = _reserve;

To be:

if (nft_reserve == address(0)) {
    records[_nftId].reserve = _reserve;
}
maximebrugel commented 2 years ago

Data location can only be specified for array, struct or mapping types and will cost more to store in a variable in this case (4 gas more).

alcueca commented 2 years ago

Dispute accepted