15,000 USDC
View results
Submission Details
Severity: gas

Check oracle price only if user owns the collateral

Summary

When getting the collateral value of an account, we are checking the oracle price for every collateral token available, even if the user has no amount for one of the collateral.

Vulnerability Details

On DSCEngine.sol in the function getAccountCollateralValue() it is only necessary to read the oracle price if the user has collateral for that token.

Impact

Using 'forge snapshot --diff' with the current tests the Overall gas change: -401882 (-2.664%)

Using 'forge test --gas-report' on the function getAccountInformation() the average gas cost before and after the optimization is from 23356 to 15038, spending -8318 gas.

Tools Used

forge snapshot

Recommendations

 function getAccountCollateralValue(address user) public view returns (uint256 totalCollateralValueInUsd) {
    for (uint256 i = 0; i < s_collateralTokens.length; i++) { 
        address token = s_collateralTokens[i]; 
        uint256 amount = s_collateralDeposited[user][token]; 
+            // @audit-issue gas. if amount != 0 check value. else no need to check  
+            if (amount != 0){ 
                totalCollateralValueInUsd += getUsdValue(token, amount); 
+            } 
    } 
     return totalCollateralValueInUsd;
 }

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.