Submission Details
Severity:
Not using Proxy pattern
Summary
Instead of using the proxy pattern for new Escrow contracts, the Escrow contract is deployed every time. This leads to unwanted gas expenditure.
Vulnerability Details
Although all Escrow contracts have the same code, a new contract is deployed everytime instead of deploying a single implementation followed by proxies.
function newEscrow(
uint256 price,
IERC20 tokenContract,
address seller,
address arbiter,
uint256 arbiterFee,
bytes32 salt
) external returns (IEscrow) {
.......
Escrow escrow = new Escrow{salt: salt}(
price,
tokenContract,
msg.sender,
seller,
arbiter,
arbiterFee
);
if (address(escrow) != computedAddress) {
revert EscrowFactory__AddressesDiffer();
}
emit EscrowCreated(address(escrow), msg.sender, seller, arbiter);
return escrow;
}
Impact
Unwanted gas expenditure of about 400000 for every new escrow contract.
Tools Used
Foundry gas reported
Recommendations
Have a single escrow implementation contract and then deploy proxies.
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.