CodeHawks Escrow Contract - Competition Details
Cyfrin
Foundry
40,000 USDC
View results
Previous Next
Submission Details
Severity: gas
Valid

Use predefined address instead of `address(this)`

codeslide

Summary

Instead of using address(this), it is more gas-efficient to pre-calculate and use the predefined address. Foundry's script.sol and Solmate's LibRlp.sol contracts can help pre-determine the address (see computeCreateAddress). The address can be passed in via a constructor argument and assigned to an immutable variable (rather than using a hardcoded constant) so that the code can remain the same across deployments on different networks.

Vulnerability Details

There are 5 instances of this issue.

File: src/Escrow.sol
​
44: if (tokenContract.balanceOf(address(this)) < price) revert Escrow__MustDeployWithTokenBalance();
​
98: i_tokenContract.safeTransfer(i_seller, i_tokenContract.balanceOf(address(this)));
​
110: uint256 tokenBalance = i_tokenContract.balanceOf(address(this));
​
125: tokenBalance = i_tokenContract.balanceOf(address(this));
File Link Instance Count Instance Links
Escrow.sol 4 44,98,110,125
File: src/EscrowFactory.sol
​
30: address(this),
File Link Instance Count Instance Link
EscrowFactory.sol 1 30

Impact

250 gas

Tools Used

baudit: a custom static code analysis tool; manual review

Recommendations

Use predefined address instead of address(this).

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.