TL;DR: Guzzling more gas than needed in https://github.com/code-423n4/2022-01-yield/blob/e946f40239b33812e54fafc700eb2298df1a2579/contracts/ConvexStakingWrapper.sol#L81:L90
Longer version: The refund rules changed for clearing a storage slot. It is cheaper to keep the slot occupied. Since you used constants for ENTERED / NOT ENTERED no readability is lost.
You might also want to adjust the eip-2200 comment.
Proof of Concept
Existing code
cat src/OldLockTest.sol
// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.6;
contract OldLockTest {
bool private _status;
bool private constant _NOT_ENTERED = false;
bool private constant _ENTERED = true;
modifier nonReentrant() {
// On the first call to nonReentrant, _notEntered will be true
require(_status != _ENTERED, "ReentrancyGuard: reentrant call");
// Any calls to nonReentrant after this point will fail
_status = _ENTERED;
_;
// By storing the original value once again, a refund is triggered (see
// https://eips.ethereum.org/EIPS/eip-2200)
_status = _NOT_ENTERED;
}
function doSomething() public nonReentrant returns (uint256) {
return 1;
}
}
Proposed code
cat src/NewLockTest.sol
// SPDX-License-Identifier: GPL-3.0-or-later
pragma solidity ^0.8.6;
contract NewLockTest {
uint private _status = 1;
uint private constant _NOT_ENTERED = 1;
uint private constant _ENTERED = 2;
modifier nonReentrant() {
// On the first call to nonReentrant, _notEntered will be true
require(_status != _ENTERED, "ReentrancyGuard: reentrant call");
// Any calls to nonReentrant after this point will fail
_status = _ENTERED;
_;
// By storing the original value once again, a refund is triggered (see
// https://eips.ethereum.org/EIPS/eip-2200)
_status = _NOT_ENTERED;
}
function doSomething() public nonReentrant returns (uint256) {
return 1;
}
}
Handle
bitbopper
Vulnerability details
Impact
TL;DR: Guzzling more gas than needed in
https://github.com/code-423n4/2022-01-yield/blob/e946f40239b33812e54fafc700eb2298df1a2579/contracts/ConvexStakingWrapper.sol#L81:L90
Longer version: The refund rules changed for clearing a storage slot. It is cheaper to keep the slot occupied. Since you used constants for ENTERED / NOT ENTERED no readability is lost. You might also want to adjust the eip-2200 comment.
Proof of Concept
Existing code
Proposed code
Diff between existing and proposed code
Outcome
Tools Used
Dapptools
Recommended Mitigation Steps
Use provided sample code