Beatland Festival
First Flight #44
Beginner FriendlyFoundrySolidityNFT
100 EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: high
Invalid

Use external for Pure/View Helper Functions

cyber00t

Description

  • Helper functions like encodeTokenId and decodeTokenId are declared public pure in the FestivalPass contract.

  • According to SoloDit/Cyfrin and Solidity best practices, marking utility functions that are only ever called externally as external can save gas by avoiding internal memory copying of parameters, especially when using arrays or large calldata.

​
// Root cause:
function encodeTokenId(...) public pure returns (...) {
@> // Should be marked external
}

Risk

Likelihood:

  • Pure helper functions are frequently invoked by external tooling, UI, and off-chain scripts.

  • While they work correctly as public, they could be marked external for improved efficiency if they are never called internally.

Impact:

Proof of Concept

// From a frontend:
festivalPass.encodeTokenId(5, 1); // Will be cheaper if external
​

Recommended Mitigation

- function encodeTokenId(uint256 collectionId, uint256 itemId) public pure returns (uint256) {
+ function encodeTokenId(uint256 collectionId, uint256 itemId) external pure returns (uint256) {
​
- function decodeTokenId(uint256 tokenId) public pure returns (uint256 collectionId, uint256 itemId) {
+ function decodeTokenId(uint256 tokenId) external pure returns (uint256 collectionId, uint256 itemId) {
​
Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.