CodeHawks Escrow Contract - Competition Details

Summary

Vulnerability Details

On external functions, when using the memory keyword with a function argument, what's happening is a memory acts as an intermediate.

When the function gets called externally, the array values are kept in calldata and copied to memory during ABI decoding (using the opcode calldataload and mstore).
And during the for loop, the values in the array are accessed in memory using a mload. That is inefficient. Reading directly from calldata using calldataload instead of going via memory saves the gas from the intermediate memory operations that carry the values.

More detail see this

There is 1 instance of this issue:

• EscrowFactory.computeEscrowAddress(bytes,address,uint256,uint256,IERC20,address,address,address,uint256) read-only memory parameters below should be changed to calldata :

  • EscrowFactory.computeEscrowAddress(bytes,address,uint256,uint256,IERC20,address,address,address,uint256).byteCode

Impact

Tools Used

Recommendations

Use calldata instead of memory for external functions where the function argument is read-only.