cryptokitties-bounty-2

cryptokitties-bounty-2 copied to clipboard

### Description Query tokensOfOwner always timeout ### Reproduction https://etherscan.io/token/0x06012c8cf97bead5deae237070f9587f8e7a266d#readContract

freehere107

Final Leaderboard

7

The winners of the CryptoKitties Offers bug bounty are as follows: Submitter | Point total | BugCat V2 -- | -- | -- @sunsetlover | 300 | Yes @TomLeeFounder |...

jordankitty

QUESTION: What advantage does the escrow provide?

3

Please forgive my naive take on this feature. I'm curious what the pros and cons are of the escrow workflow put in place. On one end of the spectrum, this...

alxo44

Save gas by writing to storage once rather than twice in .updateOffer()

5

### Description `.updateOffer()` updates both the `offer.total` property and the `offer.expiresAt` property of an `offer` struct. However, it writes each of these changes in two separate writes to storage. We...

ghost

Save gas by packing total and expiresAt into the same 256-bit word in the Offer struct

5

### Description The `Offer` struct is composed of two 256-bit words. Since the function `.updateOffer()` only updates a portion of this struct (the `total` and the `expiresAt` portions), we can...

ghost

Unnecessary fetches for pointers in three different functions when pointer already exists

2

### Description All of the following functions perform an unnecessary read from storage (which is costly in gas): `.cancelOffer()`, `.fulfillOffer()`, and `.batchRemoveExpired()`. Each of these functions calls `tokenIdToOffer[tokenId]` twice, rather...

ghost

Inconsistent use of uint256 typecasts, either remove all or add all.

2

### Description I had originally believed that these typecasts were necessary. However, I was disproven in issues #9, #11, #13, #14. There are nine unnecessary typecasts to uint256. If you...

ghost

Indexed parameters in events

2

### Description Consider adding "indexed" keyword next to the event parameters like address, IDs, etc. The indexed parameters allow filtering events by a specific value. ### Impact This is only...

pauliax

lostAndFoundAddress: there is a (potentially very low) possibility that someone owns 0x0 public address

3

### Description OffersAccessControl.sol has a function withdrawTotalLostAndFoundBalance() with the onlyLostAndFound modifier which checks if the msg.sender is the lostAndFoundAddress: `require(msg.sender == lostAndFoundAddress, "only LostAndFound is allowed to perform this operation");`...

pauliax

Optimize Offer structure (gas usage)

3

### Description As the gas inefficiencies are also in the scope, I would like to suggest packing variables in struct more efficiently. OffersBase.sol has an Offer struct: ``` struct Offer...

pauliax