code-423n4 / 2024-03-pooltogether-findings

5 stars 4 forks source link

Gas Optimizations #326

Open c4-bot-7 opened 5 months ago

c4-bot-7 commented 5 months ago

See the markdown file with the details of this report here.

raymondfam commented 5 months ago

12 generic G

c4-pre-sort commented 5 months ago

raymondfam marked the issue as sufficient quality report

c4-judge commented 5 months ago

hansfriese marked the issue as grade-b

thenua3bhai commented 5 months ago

Hi @hansfriese Thanks for quick judging.

I am quite surprised with this report's grade not being a and other grade-a reports got grade-a. Since this report contains 11 out of 12 findings which are unique from bot and only 1 finding G-5 I included here but only it's missed by bot instances because of their good gas savings. While other grade-a reports mostly have bot findings. While this contest also had a bot race. I think all those 4 reports should have awarded c or b definitely not a. Generally in c-4 gas reports unique findings from bot and analyzer are encouraged by most judges and only those findings which has good gas saving and some instances missed by bot (like related to storage var.read/write/packing) should be included here in gas reports. Generally trivial findings like(address(0) check assembly or use = + instead of +=) even some instances missed. But here in all grade-a reports most of the findings are from bot/analyzer reports and no note mentioning that it covers only missed instances since many of those reported bot findings here also contains instances which were also reported in bot report which should be un-acceptable here and should be marked known from bot in gas reports.

I have analyzed and matched all these grade-a reports with bot and analyzer report.

  1. Issue #236 which is also selected for report has 45 findings out of which 33 findings (G-1, G-2, G-4, G-6, G-8, G-9, G-11, G-12, G14-G16, G18-G21 ,G23-G26, G28, G29, G31-G38, G40, G41, G43, G44) are known from bot. In these 33 findings G6, G14, G20, G26, G32, G40 have different instances from bot otherwise 27 findings even covers similar instances with bot report which is clearly invalid to report again here if already reported in bot report.
  2. Issue #93 which is another grade-a has 15 findings out of which 12 findings (G2-G5, G7-G11, G13-G15) are known from bot ie only G1, G6, G12 unique from bot. In these 12 findings only G4 has different instances from bot otherwise 11 findings even covers similar instances with bot report. ie. only 4 valid findings.
  3. Issue #317 which is another grade-a has 15 findings out of which 7 findings (G1-G3, G5, G12-G14) are known from bot. In these 7 findings only G2, G3, G12 has different instances from bot otherwise 4 findings even covers similar instances with bot report. ie. only 11 valid findings.
  4. Issue #273 which is another grade-a has 19 findings out of which 7 findings (G3-G5, G8-G10, G15) are known from bot. In these 7 findings only G3 has different instances from bot otherwise 6 findings even covers similar instances with bot report. ie. only 13 valid findings.

Due to so many bot findings as spam these should have been invalidated or grade-c/b.

I think here lookout made a mistake in analyzing gas reports generally lookout count valid findings and mention duplicate known from bot findings also to help the judge. But here he just counted all the given findings in a gas report weather it is unique/duplicate from bot which is not sufficient for judging. I think also he treated all findings as same by counting just number of findings but all are not same eg: unique refactoring or packing can save more gas and should get more score than a address(0) check in assembly or use = + instead of += for sate var. or any trivial findings. I think by trusting lookout and by seeing those findings count numbers you awarded the grades but those numbers contains many bot findings also in them.

I request you to please look into my this report and other gas reports specially those grade-a gas reports which contains mostly bot findings and re-validate them checking the quality again and update their grades by their findings value and based on valid findings they have also by subtracting bot findings.

Thanks

hansfriese commented 5 months ago

Thanks for your valuable comment. I will validate all gas reports again.

c4-judge commented 5 months ago

hansfriese marked the issue as grade-a