Public function can be external in LockeERC20 contract functions.

[code423n4]

Handle

cyberboy

Vulnerability details

Impact

public functions that are never called by the contract should be declared external to save gas. This affects all the LockeERC20 contract functions. They have been marked as public but they can be external.

Proof of Concept

https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/LockeERC20.sol#L86-L92 - approve()
https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/LockeERC20.sol#L94-L106 - transfer()
https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/LockeERC20.sol#L108-L128 - transferFrom()
https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/LockeERC20.sol#L134-L163 - permit()

Tools Used

Slither

Recommended Mitigation Steps

Mark the following function external instead of the public to save gas.

• approve()
• transfer()
• transferFrom()
• permit()

[0xean]

dupe of #260