code423n4 commented 2 years ago

Handle

Dravee

Vulnerability details

Impact

Using both named returns and a return statement isn't necessary. Removing unused named return variables can reduce gas usage and improve code clarity. To save gas and improve code quality: consider using only one of those.

Proof of Concept

Instances include:

ConvexStakingWrapper.sol:310:    function earned(address _account) external view returns (EarnedData[] memory claimable) { //@audit-info 342: return claimable;

Cvx3CrvOracle.sol:76:        returns (uint256 quoteAmount, uint256 updateTime) //@audit-info 78: return _peek(base.b6(), quote.b6(), baseAmount);

Cvx3CrvOracle.sol:97:        returns (uint256 quoteAmount, uint256 updateTime) //@audit-info 99: return _peek(base.b6(), quote.b6(), baseAmount);

Tools Used

VS Code

Recommended Mitigation Steps

Remove the unused named returns

alcueca commented 2 years ago

We would dispute this on the grounds that we stated that gas savings below 100 gas were not in scope, but we confirm it on the grounds of a code clarity issue.

GalloDaSballo commented 2 years ago

Agree with the sponsor rationale, ultimately it's a coding style / best practice finding

code-423n4 / 2022-01-yield-findings