VULN 1

[GAS] Use != 0 instead of > 0 for unsigned integer comparison

---

Proof of concept

Found in line 119 at 2023-07-escrow/src/Escrow.sol:

    if (buyerAward > 0) {

Found in line 122 at 2023-07-escrow/src/Escrow.sol:

    if (i_arbiterFee > 0) {

Found in line 126 at 2023-07-escrow/src/Escrow.sol:

    if (tokenBalance > 0) {

---

Mitigation

Use != 0 instead of > 0 for unsigned integer comparison.

VULN 2

[GAS] Use assembly to check for address(0)

---

Proof of concept

Found in line 40 at 2023-07-escrow/src/Escrow.sol:

    if (address(tokenContract) == address(0)) revert Escrow__TokenZeroAddress();

Found in line 41 at 2023-07-escrow/src/Escrow.sol:

    if (buyer == address(0)) revert Escrow__BuyerZeroAddress();

Found in line 42 at 2023-07-escrow/src/Escrow.sol:

    if (seller == address(0)) revert Escrow__SellerZeroAddress();

Found in line 103 at 2023-07-escrow/src/Escrow.sol:

    if (i_arbiter == address(0)) revert Escrow__DisputeRequiresArbiter();

---

Mitigation

Using assembly to check for the zero address can result in significant gas savings compared to using a Solidity expression, especially if the check is performed frequently or in a loop. However, it's important to note that using assembly can make the code less readable and harder to maintain, so it should be used judiciously and with caution.

VULN 3

[GAS] Use hardcode address instead address(this)

---

Proof of concept

Found in line 30 at 2023-07-escrow/src/EscrowFactory.sol:

        address(this),

Found in line 44 at 2023-07-escrow/src/Escrow.sol:

    if (tokenContract.balanceOf(address(this)) < price) revert Escrow__MustDeployWithTokenBalance();

Found in line 98 at 2023-07-escrow/src/Escrow.sol:

    i_tokenContract.safeTransfer(i_seller, i_tokenContract.balanceOf(address(this)));

Found in line 110 at 2023-07-escrow/src/Escrow.sol:

    uint256 tokenBalance = i_tokenContract.balanceOf(address(this));

Found in line 125 at 2023-07-escrow/src/Escrow.sol:

    tokenBalance = i_tokenContract.balanceOf(address(this));

---

Mitigation

Instead of using address(this), it is more gas-efficient to pre-calculate and use the hardcoded address. Foundry’s script.sol and solmate’s LibRlp.sol contracts can help achieve this.

VULN 4

[GAS] Use assembly to write address storage values

---

Proof of concept

Found in lines 32 to 39 at 2023-07-escrow/src/Escrow.sol:

constructor(
    uint256 price,
    IERC20 tokenContract,
    address buyer,
    address seller,
    address arbiter,
    uint256 arbiterFee
) {

---

Mitigation

Use assembly to write address storage values. Here are a few reasons: * Reduced opcode usage: When using assembly, you can directly manipulate storage values using lower-level instructions like sstore (storage store) instead of relying on higher-level Solidity storage assignments. These direct operations typically result in fewer opcode executions, reducing gas costs. * Avoiding unnecessary checks: Solidity storage assignments often involve additional checks and operations, such as enforcing security modifiers or triggering events. By using assembly, you can bypass these additional checks and perform the necessary storage operations directly, resulting in gas savings. * Optimized packing: Assembly provides greater flexibility in packing and unpacking data structures. By carefully arranging and manipulating the storage layout in assembly, you can achieve more efficient storage utilization and minimize wasted storage space. * Fine-grained control: Assembly allows for precise control over gas-consuming operations. You can optimize gas usage by selecting specific instructions and minimizing unnecessary operations or data copying.