Open code423n4 opened 2 years ago
Thanks will add
Actually, the MLOAD
for details_[0]
is more expensive than the DUP
s and ADD
of another recoveredFunds + fundsCaptured
. Instead, we will just cache the result on the stack before L205
, and use it twice.
As per the sponsor's comment, the mitigation suggested by the warden is not cheaper but anyway it helped to find an optimization so I am leaving this issue as valid.
Handle
WatchPug
Vulnerability details
https://github.com/maple-labs/debt-locker/blob/81f55907db7b23d27e839b9f9f73282184ed4744/contracts/DebtLocker.sol#L205-L215
recoveredFunds + fundsCaptured
at L215 is calculated before at L205, since it's a checked arithmetic operation with two memory variables, resue the result instead of doing the arithmetic operation again can save gas.Recommendation
Change to:
require(ERC20Helper.transfer(fundsAsset, _pool, details_[0]), "DL:HCOR:TRANSFER");