code-423n4 / 2021-12-defiprotocol-findings

0 stars 0 forks source link

Auction:bondForRebalance() store calculation of bondAmount in local variable #166

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

GiveMeTestEther

Vulnerability details

Impact

Store the calculation of "basketToken.totalSupply() / factory.bondPercentDiv()" in a local variable. So we can use this local variable in the safeTransfer and the event emit (instead of reading the storage variable again with what we have assigned it in this function). We save a two SLOADs.

Proof of Concept

https://github.com/code-423n4/2021-12-defiprotocol/blob/205d3766044171e325df6a8bf2e79b37856eece1/contracts/contracts/Auction.sol#L59

Tools Used

-Manual Analysis

Recommended Mitigation Steps