Submission Details
Severity:
VAULT.sol - approveTo - unnecessary use of target instead of msg.sender
Summary
The function call is more expensive adding an extra parameter instead of msg.sender.
Vulnerability Details
There is no specific reason to NOT use msg.sender here as the token bridge is the only one able to call it and is the owner of this contract
Impact
Gas
// Result gas 37440 without onlyOwner modifier for test
function approveTo1(address target, uint256 amount) external {
token.approve(target, amount);
}
// Result gas 35260 without onlyOwner modifier for test
function approveTo2( uint256 amount) external {
token.approve(msg.sender, amount);
}
Tools Used
forge test
Recommendations
We should use msg.sender instead of target, as it will save gas. Below is the diff:
- function approveTo(address target, uint256 amount) external {
+ function approveTo(uint256 amount) external {
- token.approve(target, amount);
+ token.approve(msg.sender, amount);
}
Rewards breakdown
nSLOC
99This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.