Snowman Merkle Airdrop
AI First Flight #10
Beginner FriendlyFoundrySolidityNFT
EXP
View results
Previous Next
Submission Details
Impact: low
Likelihood: low
Invalid

[Informational] Public Function Should Be External for Gas Savings - Snowman.sol

quickmoon215

Summary

During Hour 7 of Snowman First Flight, I reviewed function visibility in Snowman.sol. Found several functions declared as public that are never called internally. Changing them to external reduces gas costs for users. No security vulnerability found.

Vulnerability Details

Severity: Low - Informational / Gas
Contract: Snowman.sol
Functions: Functions that are only called externally

Risk

Higher gas costs for users. public functions copy calldata to memory when called, while external functions can read directly from calldata. This wastes ~20-50 gas per call. No security impact.

Description

Solidity best practice: Use external for functions that are not called internally within the contract. Use public only if the function is called by other functions in the same contract. The current implementation uses public by default which is less gas efficient.

Proof of Concept

// Less efficient
function mint(address to, uint256 amount) public onlyOwner {
_mint(to, amount);
}
​
// Gas cost: copies 'to' and 'amount' to memory
​
// More efficient
function mint(address to, uint256 amount) external onlyOwner {
_mint(to, amount);
}
​
// Gas cost: reads 'to' and 'amount' directly from calldata
​
// Before
function setOwner(address newOwner) public onlyOwner {... }
function mint(address to, uint256 amount) public onlyOwner {... }
​
// After
function setOwner(address newOwner) external onlyOwner {... }
function mint(address to, uint256 amount) external onlyOwner {... }
​
## Summary
During Hour 7 of Snowman First Flight, I conducted a gas efficiency review of `Snowman.sol`. I identified that several externally-facing functions are declared as `public` instead of `external`. While this does not introduce a security vulnerability, it results in unnecessary gas costs for end users. Changing visibility to `external` where appropriate follows Solidity best practices and reduces transaction costs.
​
## Vulnerability Details
**Severity:** Low - Informational / Gas Optimization
**Contract:** Snowman.sol
**Functions Affected:** `mint(address,uint256)`, `setOwner(address)` and other external-only functions
**Category:** Gas
​
## Risk
Increased gas costs for all users interacting with the contract.
1. `public` functions copy function arguments from calldata to memory, costing extra gas
2. `external` functions can read directly from calldata, saving ~20-50 gas per parameter
3. At scale, this wastes significant ETH. Example: 10,000 mints could waste 500,000 gas
No security risk, only economic inefficiency.
​
## Description
According to the Solidity documentation and OpenZeppelin style guide, functions that are not called internally should be marked `external`. The `public` keyword forces the compiler to create both an external and internal callable version, which requires copying arguments to memory. `external` reads directly from calldata. The current code uses `public` as default which is less optimal for gas.
​
## Proof of Concept
```solidity
// Current implementation - less efficient
function mint(address to, uint256 amount) public onlyOwner {
_mint(to, amount);
}
​
function setOwner(address newOwner) public onlyOwner {
owner = newOwner;
}
​
// Gas wasted: arguments copied to memory instead of reading from calldata
​
// Optimized implementation
function mint(address to, uint256 amount) external onlyOwner {
_mint(to, amount);
}
​
function setOwner(address newOwner) external onlyOwner {
owner = newOwner;
}
Updates

Lead Judging Commences

ai-first-flight-judge Lead Judge about 6 hours ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!