Foundry DeFi Stablecoin CodeHawks Audit Contest

Summary

When getting the collateral value of an account, we are checking the oracle price for every collateral token available, even if the user has no amount for one of the collateral.

Vulnerability Details

On DSCEngine.sol in the function getAccountCollateralValue() it is only necessary to read the oracle price if the user has collateral for that token.

Impact

Using 'forge snapshot --diff' with the current tests the Overall gas change: -401882 (-2.664%)

Using 'forge test --gas-report' on the function getAccountInformation() the average gas cost before and after the optimization is from 23356 to 15038, spending -8318 gas.

Tools Used

forge snapshot

Recommendations

 function getAccountCollateralValue(address user) public view returns (uint256 totalCollateralValueInUsd) {
    for (uint256 i = 0; i < s_collateralTokens.length; i++) { 
        address token = s_collateralTokens[i]; 
        uint256 amount = s_collateralDeposited[user][token]; 
+            // @audit-issue gas. if amount != 0 check value. else no need to check  
+            if (amount != 0){ 
                totalCollateralValueInUsd += getUsdValue(token, amount); 
+            } 
    } 
     return totalCollateralValueInUsd;
 }