code-423n4 / 2022-01-openleverage-findings

0 stars 0 forks source link

Use `calldata` for array parameters that aren't modified #258

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

Ruhum

Vulnerability details

Impact

Using calldata is less expensive than memory. It can only be used in external functions tho and the parameter can't be modified.

Proof of Concept

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L125

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L131

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L163

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/XOLE.sol#L70

Tools Used

Recommended Mitigation Steps

use calldata wherever you can

ColaM12 commented 2 years ago

Duplicate to #29