Handle

IllIllI

Vulnerability details

Impact

When the value of the post-loop increment/decrement is not stored or used in any calculations, the prefix increment/decrement operators (++i/--i) cost less gas PER LOOP than the postfix increment/decrement operators (i++/i--)

Proof of Concept

There are 27 instances of this issue in the repository:

for (uint i = 0; i < nonce.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/XOLE.sol#L362

for (uint i = 0; i < dexName.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/eth/EthDexAggregatorV1.sol#L48

for (uint i = 1; i < tokens.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/eth/UniV2Dex.sol#L59

for (uint i = 0; i < path.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/eth/UniV3Dex.sol#L75

for (uint i = 1; i < tokens.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/bsc/UniV2ClassDex.sol#L60

for (uint i = 0; i < dexName.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/dex/bsc/BscDexAggregatorV1.sol#L46

for (uint i = 0; i < length; i++){

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/lib/DexData.sol#L89

for (uint i = 0; i < length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/lib/DexData.sol#L114

for (uint i = 0; i < length - 1; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/lib/DexData.sol#L139

for (uint i = 0; i < traders.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/periphery/QueryHelper.sol#L69

for (uint i = 0; i < traders.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/periphery/QueryHelper.sol#L112

for (uint i = 0; i < pools.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/periphery/QueryHelper.sol#L225

for (uint i = 0; i < _supportDexs.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/OpenLevV1.sol#L52

for (uint i = 0; i < proposal.targets.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/gov/GovernorAlpha.sol#L202

for (uint i = 0; i < proposal.targets.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/gov/GovernorAlpha.sol#L228

for (uint i = 0; i < proposal.targets.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/gov/GovernorAlpha.sol#L280

for (uint i = 0; i < support.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/gov/GovernorAlpha.sol#L307

for (uint256 i = 0; i < _excluded.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/test/MockTaxToken.sol#L187

for (uint256 i = 0; i < _excluded.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/test/MockTaxToken.sol#L287

for (uint256 i = 0; i < stakeTokens.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L126

for (uint256 i = 0; i < stakeTokens.length; ++i) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L132

for (uint256 i = 0; i < stakeTokens.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/farming/FarmingPools.sol#L164

for (uint i = 0; i < lpools.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/ControllerV1.sol#L303

for (uint i = 0; i < marketIds.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/ControllerV1.sol#L375

for (uint256 i = 0; i < len; i ++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/Airdrop.sol#L64

for (uint i = 0; i < beneficiaries.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/OLETokenLock.sol#L33

for (uint i = 0; i < dexs.length; i++) {

https://github.com/code-423n4/2022-01-openleverage/blob/main/openleverage-contracts/contracts/OpenLevV1Lib.sol#L260

Tools Used

Code inspection

Recommended Mitigation Steps

Use ++i rather than i++ in all places

code-423n4 / 2022-01-openleverage-findings