BorrowerGateway Static Analysis Findings

BGY-01S: Data Location Optimization

Type	Severity	Location
Gas Optimization		BorrowerGateway.sol:L34

Description:

The linked input argument is set as memory in an external function.

Example:

Copy
28function borrowWithOffChainQuote(
29    address lenderVault,
30    DataTypesPeerToPeer.BorrowTransferInstructions
31        calldata borrowInstructions,
32    DataTypesPeerToPeer.OffChainQuote calldata offChainQuote,
33    DataTypesPeerToPeer.QuoteTuple calldata quoteTuple,
34    bytes32[] memory proof
35) external nonReentrant {

Recommendation:

We advise it to be set as calldata optimizing its read-access gas cost.

Alleviation (c740f7c6b5ebd365618fd2d7ea77370599e1ca11):

The referenced data location of the proof array input has been set to calldata optimally, addressing this exhibit.

BGY-02S: Inexistent Sanitization of Input Address

Type	Severity	Location
Input Sanitization		BorrowerGateway.sol:L24-L26

Description:

The linked function accepts an address argument yet does not properly sanitize it.

Impact:

The presence of zero-value addresses, especially in constructor implementations, can cause the contract to be permanently inoperable. These checks are advised as zero-value inputs are a common side-effect of off-chain software related bugs.

Example:

Copy
24constructor(address _addressRegistry) {
25    addressRegistry = _addressRegistry;
26}

Recommendation:

We advise some basic sanitization to be put in place by ensuring that the address specified is non-zero.

Alleviation (c740f7c6b5ebd365618fd2d7ea77370599e1ca11):

The input address of the BorrowerGateway::constructor is properly sanitized against the zero address in the latest implementation, ensuring that the contract cannot be accidentally misconfigured during its deployment.