code-423n4 / 2022-01-trader-joe-findings

2 stars 0 forks source link

Gas in `LaunchEvent.sol:withdrawLiquidity()`: `address(pair)` should get cached #180

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

Dravee

Vulnerability details

Impact

SLOADs are expensive (~100 gas) compared to MLOADs/MSTOREs (~3 gas). Minimizing them can save gas.

Proof of Concept

The code is as such (see @audit-info comments):

File: LaunchEvent.sol
438:     function withdrawLiquidity() external isStopped(false) timelockElapsed {
439:         require(address(pair) != address(0), "LaunchEvent: pair not created"); //@audit-info SLOAD
440: 
441:         UserInfo storage user = getUserInfo[msg.sender];
442:         require(
443:             !user.hasWithdrawnPair,
444:             "LaunchEvent: liquidity already withdrawn"
445:         );
446: 
447:         uint256 balance = pairBalance(msg.sender);
448:         user.hasWithdrawnPair = true;
449: 
450:         if (msg.sender == issuer) {
451:             balance = lpSupply / 2;
452: 
453:             emit IssuerLiquidityWithdrawn(msg.sender, address(pair), balance); //@audit-info SLOAD
454: 
455:             if (tokenReserve > 0) {
456:                 uint256 amount = tokenReserve;
457:                 tokenReserve = 0;
458:                 token.transfer(msg.sender, amount);
459:             }
460:         } else {
461:             emit UserLiquidityWithdrawn(msg.sender, address(pair), balance); //@audit-info SLOAD
462:         }
463: 
464:         pair.transfer(msg.sender, balance);
465:     }

1 SLOAD could be saved by caching address(pair)

Tools Used

VS Code

Recommended Mitigation Steps

Use caching on address(pair)