Beedle - Oracle free perpetual lending

Summary

abi.encode(..) is less efficient than abi.encodePacked(....)

Vulnerability Details

poolId = keccak256(abi.encode(lender, loanToken, collateralToken)); // Lender.sol line 113
abi.encode(loan.lender, loan.loanToken, loan.collateralToken); // Lender.sol line 571
abi.encode(loans[loanId].lender,.... // Lender.sol line 596

Impact

Gas: abi.encode(...) pads parameters with 32 bytes whereas abi.encodePacked() does not pad the parameters using minimal space for type which is cheaper gas wise. The bigger the encoded bytes the more expensive. Cost of keccak is about 30 gas + 6 gas for each word (rounded up) for input data; so it increases with input data size

Tools Used

Manual Analysis

Recommendations

It is recommended to replace all instances of abi.encode() with abi.encodePacked() as in example below
poolId = keccak256(abi.encodePacked(lender, loanToken, collateralToken)); // Beedle.sol line 113