Beedle - Oracle free perpetual lending

Summary

Vulnerability Details

The instances below point to the second+ access of a state variable within a function. Caching of a state variable replaces each Gwarmaccess (100 gas) with a much cheaper stack read. Other less obvious fixes/optimizations include having local memory caches of state variable structs, or having local caches of state variable contracts/addresses.

More detail see this.

There are 10 instances of this issue:

• Fees.WETH should be cached with local memory-based variable in Fees.sellProfits(address), It is called more than once:

  • params = ISwapRouter.ExactInputSingleParams(_profits,WETH,3000,address(this),block.timestamp,amount,0,0)

  • IERC20(WETH).transfer(staking,IERC20(WETH).balanceOf(address(this)))

  • require(bool,string)(_profits != WETH,not allowed)

• Staking.balance should be cached with local memory-based variable in Staking.update(), It is called more than once:

  • _balance > balance

  • _diff = _balance - balance

• Lender.feeReceiver should be cached with local memory-based variable in Lender.refinance(Refinance[]), It is called more than once:

  • IERC20(loan.loanToken).transfer(feeReceiver,protocolInterest)

  • IERC20(loan.loanToken).transfer(feeReceiver,fee)

• Lender.pools should be cached with local memory-based variable in Lender.refinance(Refinance[]), It is called more than once:

  • _updatePoolBalance(poolId,pools[poolId].poolBalance - debt)

  • pool = pools[poolId]

  • _updatePoolBalance(oldPoolId,pools[oldPoolId].poolBalance + loan.debt + lenderInterest)

• Lender.pools should be cached with local memory-based variable in Lender.addToPool(bytes32,uint256), It is called more than once:

  • IERC20(pools[poolId].loanToken).transferFrom(msg.sender,address(this),amount)

  • pools[poolId].lender != msg.sender

  • _updatePoolBalance(poolId,pools[poolId].poolBalance + amount)

• Lender.pools should be cached with local memory-based variable in Lender.setPool(Pool), It is called more than once:

  • p.outstandingLoans != pools[poolId].outstandingLoans

  • currentBalance = pools[poolId].poolBalance

  • pools[poolId].lender == address(0)

• Lender.pools should be cached with local memory-based variable in Lender.borrow(Borrow[]), It is called more than once:

  • _updatePoolBalance(poolId,pools[poolId].poolBalance - debt)

  • pool = pools[poolId]

• Lender.pools should be cached with local memory-based variable in Lender.removeFromPool(bytes32,uint256), It is called more than once:

  • _updatePoolBalance(poolId,pools[poolId].poolBalance - amount)

  • pools[poolId].lender != msg.sender

  • IERC20(pools[poolId].loanToken).transfer(msg.sender,amount)

• Lender.pools should be cached with local memory-based variable in Lender.buyLoan(uint256,bytes32), It is called more than once:

  • _updatePoolBalance(oldPoolId,pools[oldPoolId].poolBalance + loan.debt + lenderInterest)

  • pools[poolId].poolBalance < totalDebt

  • _updatePoolBalance(poolId,pools[poolId].poolBalance - totalDebt)

  • pools[poolId].interestRate > currentAuctionRate

  • Borrowed(loan.borrower,msg.sender,loanId,loans[loanId].debt,loans[loanId].collateral,pools[poolId].interestRate,block.timestamp)

• Lender.loans should be cached with local memory-based variable in Lender.refinance(Refinance[]), It is called more than once:

  • loan = loans[loanId]

  • oldPoolId = keccak256(bytes)(abi.encode(loans[loanId].lender,loans[loanId].loanToken,loans[loanId].collateralToken))

Impact

Tools Used

Recommendations

Cache storage-based state variables in local memory-based variables appropriately to convert SLOADs to MLOADs and reduce gas consumption from 100 units to 3 units. than once for a function