20,000 USDC
View results
Submission Details
Severity: gas
Valid

Using hardcoded strings instead of custom errors will result in more gas consumption

Summary

Using hardcoded strings instead of custom errors will result in more gas consumption

Vulnerability Details

In the below examples, we can see that hardcoded strings are used instead of custom error type definitions. Although there is nothing wrong with this approach, we can change it in a way that will result in more gas-efficient code. There are two instances where this optimization can be considered. For one of the error messages, we already declared an error in the Errors.sol file, so we can use it instead of the "UNAUTHORIZED" string message.

There are a total of two instances where this problem occurs:

Ownable.sol

https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/utils/Ownable.sol#L10C1-L13C6

modifier onlyOwner() virtual {
require(msg.sender == owner, "UNAUTHORIZED");
_;
}

Fees.sol

https://github.com/Cyfrin/2023-07-beedle/blob/658e046bda8b010a5b82d2d85e824f3823602d27/src/Fees.sol#L24C1-L45C2

/// @notice swap loan tokens for collateral tokens from liquidations
/// @param _profits the token to swap for WETH
function sellProfits(address _profits) public {
require(_profits != WETH, "not allowed");
uint256 amount = IERC20(_profits).balanceOf(address(this));
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter
.ExactInputSingleParams({
tokenIn: _profits,
tokenOut: WETH,
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: amount,
amountOutMinimum: 0,
sqrtPriceLimitX96: 0
});
amount = swapRouter.exactInputSingle(params);
IERC20(WETH).transfer(staking, IERC20(WETH).balanceOf(address(this)));
}
}

Impact

This approach will lead to using more gas while running the code and overall more gas consumption

Tools Used

Manual Review

Recommendations

Try to avoid implementing checks with hardcoded string messages and strive to build more gas-efficient and better-performing code by using custom errors. Consider adding a new error in the Errors.sol file and reconsidering the logic in the onlyOwner modifier by replacing the hardcoded string with error Unauthorized();.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.