CodeHawks Escrow Contract - Competition Details

Summary

It may be better to use minimal proxy pattern with initialization instead of deploying big amount of contracts with the same logic.

Vulnerability Details

Minimal proxy pattern with initialization saves significant amounts of gas by reducing the contract deployment cost. In our case, EscrowFactory::newEscrow() just deploys a new Escrow contract. This can be optimized by deploying it using minimal proxy pattern with initialization instead, which does not contain all the bytecode of Escrow in itself, but delegatecalls to implementation contract (the deployed logic of Escrow contract). In this case, you should use storage state variables in Escrow contract instead of immutable ones.

Impact

Increased both Escrow contract deployment cost and EscrowFactory::newEscrow() interaction cost.

Tools Used

Foundry

Recommendations

Use minimal proxy pattern with initialization when deploying new Escrow contracts in EscrowFactory::newEscrow().

See: https://www.rareskills.io/post/eip-1167-minimal-proxy-standard-with-initialization-clone-pattern