Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade pragma to at least 0.8.4 #29

Open
code423n4 opened this issue Nov 6, 2021 · 0 comments
Open

Upgrade pragma to at least 0.8.4 #29

code423n4 opened this issue Nov 6, 2021 · 0 comments
Labels
bug Something isn't working G (Gas Optimization) sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")

Comments

@code423n4
Copy link
Contributor

Handle

defsec

Vulnerability details

Impact

Using newer compiler versions and the optimizer gives gas optimizations
and additional safety checks are available for free.

The advantages of versions 0.8.* over <0.8.0 are:

  • Safemath by default from 0.8.0 (can be more gas efficient than
    library based safemath.)
  • Low level inliner : from 0.8.2, leads to cheaper runtime gas. Especially relevant when the contract has small functions. For example, OpenZeppelin libraries typically have a lot of small helper functions and if they are not inlined, they cost an additional 20 to 40 gas because of 2 extra jump instructions and additional stack operations needed for function calls.
  • Optimizer improvements in packed structs: Before 0.8.3, storing packed structs, in some cases used an
    additional storage read operation. After EIP-2929, if the slot was already cold, this means unnecessary stack operations and extra deploy time costs. However, if the slot was already warm, this means
    additional cost of 100 gas alongside the same unnecessary stack operations and extra deploy time costs.
  • Custom errors from 0.8.4, leads to cheaper deploy time cost and run time cost. Note: the run time cost is only relevant when the revert condition is met. In short, replace revert strings by custom errors.

Proof of Concept

  1. The contest repository contracts contain pragma 0.6.12^. The contracts pragma version should be updated to 0.8.4.

(https://github.com/code-423n4/2021-11-bootfinance/blob/main/customswap/contracts/Swap.sol )
(https://github.com/code-423n4/2021-11-bootfinance/blob/main/customswap/contracts/SwapUtils.sol#L3)
(https://github.com/code-423n4/2021-11-bootfinance/blob/main/customswap/contracts/MathUtils.sol#L3)
(https://github.com/code-423n4/2021-11-bootfinance/blob/main/tge/contracts/PublicSale.sol#L2)
(https://github.com/code-423n4/2021-11-bootfinance/blob/main/tge/contracts/PublicSaleBatchWithdraw.sol#L2)

Tools Used

None

Recommended Mitigation Steps

Consider to upgrade pragma to at least 0.8.4.

@code423n4 code423n4 added bug Something isn't working G (Gas Optimization) labels Nov 6, 2021
code423n4 added a commit that referenced this issue Nov 6, 2021
@chickenpie347 chickenpie347 added the sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity") label Jan 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working G (Gas Optimization) sponsor confirmed Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")
Projects
None yet
Development

No branches or pull requests

2 participants