code-423n4 / 2022-07-swivel-findings

0 stars 1 forks source link

Gas Optimizations #183

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

[G-1]- FUNCTIONS GUARANTEED TO REVERT WHEN CALLED BY NORMAL USERS CAN BE MARKED PAYABLE :

If a function is set to only be called by owner or a specific user, the function will revert if a normal user tries to pay the function. Marking the function as payable will lower the gas cost for the owner because the compiler will not include checks for whether a payment was provided. The extra opcodes avoided are :

CALLVALUE(gas=2), DUP1(gas=3), ISZERO(gas=3), PUSH2(gas=3), JUMPI(gas=10), PUSH1(gas=3), DUP1(gas=3), REVERT(gas=0), JUMPDEST(gas=1), POP(gas=2).

Which costs an average of about 21 gas per call to the function, in addition to the extra deployment cost. There are many instances of this :

File: Creator/Creator.sol

line 47 : function setAdmin(address a) external authorized(admin) returns (bool) line 54 : function setMarketPlace(address m) external authorized(admin) returns (bool)

File: Creator/ZcToken.sol

line 140 : function burn(address f, uint256 a) external onlyAdmin(address(redeemer)) returns (bool) line 147 : function mint(address t, uint256 a) external onlyAdmin(address(redeemer)) returns (bool)

File: Creator/VaultTracker.sol

line 49 : function addNotional(address o, uint256 a) external authorized(admin) returns (bool) line 82 : function removeNotional(address o, uint256 a) external authorized(admin) returns (bool) line 113 : function redeemInterest(address o) external authorized(admin) returns (uint256) line 143 : function matureVault(uint256 c) external authorized(admin) returns (bool) line 152 : function transferNotionalFrom(address f, address t, uint256 a) external authorized(admin) returns (bool) line 208 : function transferNotionalFee(address f, uint256 a) external authorized(admin) returns(bool)

File: MarketPlace/MarketPlace.sol

line 45 : function setSwivel(address s) external authorized(admin) returns (bool) line 53 : function setAdmin(address a) external authorized(admin) returns (bool) line 115 : function mintZcTokenAddingNotional(uint8 p, address u, uint256 m, address t, uint256 a) external authorized(swivel) unpaused(p) returns (bool)

robrobbins commented 2 years ago

this quirk of the runtime is a misdirection imo. methods with no intent of taking value shouldn't me marked as payable (tho it costs 30 gas yes)