CodeHawks Escrow Contract - Competition Details

Summary

Current implementation deploys whole Escrow contract, which costs 591900 gas according to gas report. This amount can be reduced via ERC1167 Minimal proxy to near 100k.

Vulnerability Details

ERC1167 reduces deployment cost on deploying contracts with similar logic, you can check standard for detailed explanation

Impact

Reduces gas cost of Escrow deploy from 591k gas to ~100k. 100k is because initialize function must perform at least 5 SLOAD to set Escrow variables, each SLOAD costs 20k.

Tools Used

Manual Review, Foundry

Recommendations

1. Replace constructor in Escrow with function initialize

2. Make variables in Escrow non-immutable, because immutable is stored in bytecode which will be cloned otherwise

3. Create storage variable address implementation in EscrowFactory.sol. This contract will be cloned

4. Deploy Escrow in EscrowFactory.sol via OpenZeppelin's Clones.cloneDeterministic