Foundry DeFi Stablecoin CodeHawks Audit Contest

ID	Title	Category	Severity	Instances
[1]	The owner is a single point of failure and a centralization risk	Centralization / Privilege	Low	2
[2]	Void constructor	Coding Style	Low	1
[3]	Unbounded loop	Control Flow	Low	2
[4]	Use Ownable2Step's transfer function rather than Ownable's for transfers of ownership	Centralization / Privilege	Low	1
[5]	onlyOwner functions not accessible if owner renounces ownership	Centralization / Privilege	Low	2
[6]	Minting tokens to the zero address should be avoided	Control Flow	Low	1
[7]	Functions return bool true but cannot return false	Logical Issue	Low	1
[8]	Solidity version 0.8.20 may not work on other chains due to PUSH0	Volatile Code	Low	2
[1]	Functions guaranteed to revert when called by normal users can be marked payable	Gas Optimization	Informational	2
[2]	Floating pragma	Coding Style	Informational	2
[3]	Unspecific compiler version pragma	Coding Style	Informational	2
[4]	Use a more recent version of solidity	Coding Style	Informational	2
[5]	Variables need not be initialized to zero	Coding Style	Informational	2
[6]	Use a single file for all system-wide constants	Coding Style	Informational	6
[7]	Not using the named return variables anywhere in the function is confusing	Coding Style	Informational	2
[8]	Uppercase immutable variables	Coding Style	Informational	1
[9]	Consider using named mappings	Coding Style	Informational	3
[10]	Consider disabling renounceOwnership()	Control Flow	Informational	1
[11]	Consider bounding input array length	Control Flow	Informational	2
[12]	Control structures do not follow the Solidity Style Guide	Coding Style	Informational	8
[13]	Reduce gas usage by moving to Solidity 0.8.19 or later	Gas Optimization	Informational	2
[14]	Event is not properly indexed	Coding Style	Informational	1
[15]	Events may be emitted out of order due to reentranc	Logical Issue	Informational	1
[16]	Cache array length outside of loop	Gas Optimization	Informational	2
[17]	Functions guaranteed to revert when called by normal users can be marked payable	Gas Optimization	Informational	2
[18]	>= costs less gas than >	Gas Optimization	Informational	4
[19]	++i costs less gas than i++, especially when it's used in for-loops (--i/i-- too)	Gas Optimization	Informational	2
[20]	x += y/x -= y costs more gas than x = x + y/x = x - y for state variables	Gas Optimization	Informational	3
[21]	Don't initialize variables with default value	Gas Optimization	Informational	2
[22]	Inverting the condition of an if-else-statement wastes gas	Gas Optimization	Informational	1
[23]	++i/i++ should be unchecked{++i}/unchecked{i++} when it is not possible for them to overflow, as is the case when used in for- and while-loops	Gas Optimization	Informational	2
[24]	Use constants instead of type(uintx).max	Gas Optimization	Informational	1
[25]	Use shift Right/Left instead of division/multiplication if possible	Gas Optimization	Informational	5
[26]	Constructors can be marked payable	Gas Optimization	Informational	4
[27]	Reduce gas usage by moving to Solidity 0.8.19 or later	Gas Optimization	Informational	2
[28]	Multiple address/ID mappings can be combined into a single mapping of an address/ID to a struct, where appropriate	Gas Optimization	Informational	3
[29]	Unnecessary cast	Gas Optimization	Informational	2
[30]	Calling .length in a for loop wastes gas	Gas Optimization	Informational	2
[31]	unchecked {} can be used on the division of two uints in order to save gas	Gas Optimization	Informational	2

L-1 | The owner is a single point of failure and a centralization risk

Description :-

Having a single EOA as the only owner of contracts is a large centralization risk and a single point of failure. A single private key may be taken in a hack, or the sole holder of the key may become unable to retrieve the key when necessary. Consider changing to a multi-signature setup, or having a role-based authorization model.

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L46

Context:-

DecentralizedStableCoin.sol#L57

L-2 | Void constructor

Description :-

Detect the call to a constructor that is not implemented.

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L44

L-3 | Unbounded loop

Description :-

While looping large collections, it's possible to run out of gas - causing a DOS condition

Proof Of Concept

Context:-

DSCEngine.sol#L118

Context:-

DSCEngine.sol#L353

L-4 | Use Ownable2Step's transfer function rather than Ownable's for transfers of ownership

Description :-

Ownable2Step and Ownable2StepUpgradeable prevent the contract ownership from mistakenly being transferred to an address that cannot handle it (e.g. due to a typo in the address), by requiring that the recipient of the owner permissions actively accept via a contract call of its own.

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L39

L-5 | onlyOwner functions not accessible if owner renounces ownership

Description :-

The owner is able to perform certain privileged activities, but it's possible to set the owner to address(0). This can represent a certain risk if the ownership is renounced for any other reason than by design. Renouncing ownership will leave the contract without an owner, therefore limiting any functionality that needs authority.

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L46

Context:-

DecentralizedStableCoin.sol#L57

L-6 | Minting tokens to the zero address should be avoided

Description :-

The core function mint is used by users to mint an option position by providing token1 as collateral and borrowing the max amount of liquidity. Address(0) check is missing in both this function and the internal function _mint, which is triggered to mint the tokens to the to address. Consider applying a check in the function to ensure tokens aren't minted to the zero address.

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L64

L-7 | Functions return bool true but cannot return false

Description :-

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L65

L-8 | Solidity version 0.8.20 may not work on other chains due to PUSH0

Description :-

The compiler for Solidity 0.8.20 switches the default target EVM version to Shanghai, which includes the new PUSH0 op code. This op code may not yet be implemented on all L2s, so deployment on these chains will fail. To work around this issue, use an earlier EVM version

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L24

Context:-

DSCEngine.sol#L24

NC-1 | Functions guaranteed to revert when called by normal users can be marked payable

Description :-

If a function modifier such as onlyOwner is used, the function will revert if a normal user tries to pay the function. Marking the function as payable will lower the gas cost for legitimate callers because the compiler will not include checks for whether a payment was provided.

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L46

Context:-

DecentralizedStableCoin.sol#L57

NC-2 | Floating pragma

Description :-

use fixed solidity version

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L24

Context:-

DSCEngine.sol#L24

NC-3 | Unspecific compiler version pragma

Description :-

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L24

Context:-

DSCEngine.sol#L24

NC-4 | Use a more recent version of solidity

Description :-

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L24

Context:-

DSCEngine.sol#L24

NC-5 | Variables need not be initialized to zero

Description :-

The default value for variables is zero, so initializing them to zero is superfluous.

Proof Of Concept

Context:-

DSCEngine.sol#L118

Context:-

DSCEngine.sol#L353

NC-6 | Use a single file for all system-wide constants

Description :-

Consider defining in only one contract so that values cannot become out of sync when only one location is updated. A cheap way to store constants in a single location is to create an internal constant in a library. If the variable is a local cache of another contract’s value, consider making the cache variable internal or private, which will require external users to query the contract with the source of truth, so that callers don’t get out of sync.

Proof Of Concept

Context:-

DSCEngine.sol#L70

Context:-

DSCEngine.sol#L71

Context:-

DSCEngine.sol#L72

Context:-

DSCEngine.sol#L73

Context:-

DSCEngine.sol#L74

Context:-

DSCEngine.sol#L75

NC-7 | Not using the named return variables anywhere in the function is confusing

Description :-

Consider changing the variable to be an unnamed one, since the variable is never assigned, nor is it returned by name. If the optimizer is not turned on, leaving the code as it is will also waste gas for the stack variable.

Proof Of Concept

Context:-

DSCEngine.sol#L312

Context:-

DSCEngine.sol#L390

NC-8 | Uppercase immutable variables

Description :-

Variable does not follow Solidity naming best pratices

Proof Of Concept

Context:-

DSCEngine.sol#L82

NC-9 | Consider using named mappings

Description :-

Consider moving to solidity version 0.8.18 or later, and using named mappings to make it easier to understand the purpose of each mapping.

Proof Of Concept

Context:-

DSCEngine.sol#L77

Context:-

DSCEngine.sol#L78

Context:-

DSCEngine.sol#L79

NC-10 | Consider disabling renounceOwnership()

Description :-

If the plan for your project does not include eventually giving up all ownership control, consider overwriting OpenZeppelin's Ownable's renounceOwnership() function in order to disable it.

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L39

NC-11 | Consider bounding input array length

Description :-

The functions below take in an unbounded array, and make function calls for entries in the array. While the function will revert if it eventually runs out of gas, it may be a nicer user experience to require() that the length of the array is below some reasonable maximum, so that the user doesn't have to use up a full transaction's gas only to see that the transaction reverts.

Proof Of Concept

Context:-

DSCEngine.sol#L118

Context:-

DSCEngine.sol#L353

NC-12 | Control structures do not follow the Solidity Style Guide

Description :-

See the control structures section of the Solidity Style Guide

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L48

Context:-

DecentralizedStableCoin.sol#L61

Context:-

DSCEngine.sol#L96

Context:-

DSCEngine.sol#L103

Context:-

DSCEngine.sol#L114

Context:-

DSCEngine.sol#L158

Context:-

DSCEngine.sol#L276

Context:-

DSCEngine.sol#L288

NC-13 | Reduce gas usage by moving to Solidity 0.8.19 or later

Description :-

See this link for the full details

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L24

Context:-

DSCEngine.sol#L24

NC-14 | Event is not properly indexed

Description :-

The emitted events are not indexed, making off-chain scripts such as front-ends of dApps difficult to filter the events efficiently.

Proof Of Concept

Context:-

DSCEngine.sol#L88-L90

NC-15 | Events may be emitted out of order due to reentranc

Description :-

Ensure that events follow the best practice of check-effects-interaction, and are emitted before external calls

Proof Of Concept

Context:-

DSCEngine.sol#L156

G-1 | Cache array length outside of loop

Description :-

If not cached, the solidity compiler will always read the length of the array during each iteration. That is, if it is a storage array, this is an extra sload operation (100 additional extra gas for each iteration except for the first) and if it is a memory array, this is an extra mload operation (3 additional gas for each iteration except for the first).

Proof Of Concept

Context:-

DSCEngine.sol#L118

Context:-

DSCEngine.sol#L353

G-2 | Functions guaranteed to revert when called by normal users can be marked payable

Description :-

If a function modifier such as onlyOwner is used, the function will revert if a normal user tries to pay the function. Marking the function as payable will lower the gas cost for legitimate callers because the compiler will not include checks for whether a payment was provided.

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L46

Context:-

DecentralizedStableCoin.sol#L57

G-3 | >= costs less gas than >

Description :-

The compiler uses opcodes GT and ISZERO for solidity code that uses >, but only requires LT for >=, which saves 3 gas

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L51

Context:-

DSCEngine.sol#L118

Context:-

DSCEngine.sol#L319

Context:-

DSCEngine.sol#L353

G-4 | ++i costs less gas than i++, especially when it's used in for-loops (--i/i-- too)

Description :-

Saves 5 gas per loop

Proof Of Concept

Context:-

DSCEngine.sol#L118

Context:-

DSCEngine.sol#L353

G-5 | x += y/x -= y costs more gas than x = x + y/x = x - y for state variables

Description :-

Using the addition operator instead of plus-equals saves 113 gas

Proof Of Concept

Context:-

DSCEngine.sol#L155

Context:-

DSCEngine.sol#L198

Context:-

DSCEngine.sol#L356

G-6 | Don't initialize variables with default value

Description :-

If a variable is not initialized, it is assumed to have the default value. Explicitly initializing a variable with its default value costs unnecessary gas. For more info, see Mudit Gupta's Blog at point No need to initialize variables with default values .

Proof Of Concept

Context:-

DSCEngine.sol#L118

Context:-

DSCEngine.sol#L353

G-7 | Inverting the condition of an if-else-statement wastes gas

Description :-

Flipping the true and false blocks instead saves 3 gas

Proof Of Concept

Context:-

DSCEngine.sol#L243

G-8 | ++i/i++ should be unchecked{++i}/unchecked{i++} when it is not possible for them to overflow, as is the case when used in for- and while-loops

Description :-

The unchecked keyword is new in solidity version 0.8.0, so this only applies to that version or higher, which these instances are. This saves 30-40 gas per loop

Proof Of Concept

Context:-

DSCEngine.sol#L118

Context:-

DSCEngine.sol#L353

G-9 | Use constants instead of type(uintx).max

Description :-

it uses more gas in the distribution process and also for each transaction than constant usage.

Proof Of Concept

Context:-

DSCEngine.sol#L329

G-10 | Use shift Right/Left instead of division/multiplication if possible

Description :-

A division/multiplication by any number x being a power of 2 can be calculated by shifting log2(x) to the right/left. While the DIV opcode uses 5 gas, the SHR opcode only uses 3 gas. Furthermore, Solidity's division operation also includes a division-by-0 prevention which is bypassed using shifting.

Proof Of Concept

Context:-

DSCEngine.sol#L117

Context:-

DSCEngine.sol#L117

Context:-

DSCEngine.sol#L117

Context:-

DSCEngine.sol#L251

Context:-

DSCEngine.sol#L330

G-11 | Constructors can be marked payable

Description :-

Payable functions cost less gas to execute, since the compiler does not have to add extra checks to ensure that a payment wasn't provided. A constructor can safely be marked as payable, since only the deployer would be able to pass funds, and the project itself would not pass any funds.

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L15

Context:-

DecentralizedStableCoin.sol#L44

Context:-

DSCEngine.sol#L15

Context:-

DSCEngine.sol#L112

G-12 | Reduce gas usage by moving to Solidity 0.8.19 or later

Description :-

See this link for the full details

Proof Of Concept

Context:-

DecentralizedStableCoin.sol#L24

Context:-

DSCEngine.sol#L24

G-13 | Multiple address/ID mappings can be combined into a single mapping of an address/ID to a struct, where appropriate

Description :-

Saves a storage slot for the mapping. Depending on the circumstances and sizes of types, can avoid a Gsset (20000 gas) per mapping combined. Reads and subsequent writes can also be cheaper when a function requires both values and they both fit in the same storage slot.

Proof Of Concept

Context:-

DSCEngine.sol#L77

Context:-

DSCEngine.sol#L78

Context:-

DSCEngine.sol#L79

G-14 | Unnecessary cast

Description :-

Proof Of Concept

Context:-

DSCEngine.sol#L347

Context:-

DSCEngine.sol#L366

G-15 | Calling .length in a for loop wastes gas

Description :-

Rather than calling .length for an array in a for loop declaration, it is far more gas efficient to cache this length before and use that instead. This will prevent the array length from being called every loop iteration

Proof Of Concept

Context:-

DSCEngine.sol#L118

Context:-

DSCEngine.sol#L353

G-16 | unchecked {} can be used on the division of two uints in order to save gas

Description :-

Proof Of Concept

Context:-

DSCEngine.sol#L117

Context:-

DSCEngine.sol#L117