Trick or Treat

Summary

The current contract design initializes treats in the constructor by requiring an array of Treat structs as input. This approach leads to high gas costs during deployment, especially when adding a large number of treats (e.g., 100+). Initializing treats within the constructor also risks exceeding the block gas limit, making deployment expensive or potentially impossible on certain networks.

Vulnerability Details

The constructor currently initializes treats using a loop to add each treat from an array input.

1. High Gas Costs: Storing multiple Treat structs in a single transaction directly increases gas usage, making deployment costly.

Impact

Increased Deployment Costs: Deploying with a large number of treats can be prohibitively expensive due to the high gas costs.

Tools Used

manual review

Recommendations

Refactor the treat initialization by removing the treat array parameter from the constructor and using a batch addition function that allows treats to be added after deployment:

This approach will:

• Reduce Deployment Gas Costs: By deploying the contract with an empty treat list, deployment becomes lighter and more gas-efficient.