Gas Savings Upon Market Creation

[code423n4]

Handle

leastwood

Vulnerability details

Impact

The owner is able to deploy new markets by interacting with MarketPlace.sol and calling createMarket(). A corresponding ZcToken and vault are deployed at a fixed cost which is rather high due to the associated bytecode storage costs. Openzeppelin's Clones library offers a cheap alternative to standard deployment setups by cloning the contract functionality while still utilising the same bytecode. This is made possible by delegating all calls to a base contract

Proof of Concept

https://github.com/Swivel-Finance/gost/blob/v2/test/marketplace/MarketPlace.sol#L53-L70
https://docs.openzeppelin.com/contracts/3.x/api/proxy#minimal_clones
https://eips.ethereum.org/EIPS/eip-1167

Tools Used

Manual code review

Recommended Mitigation Steps

Consider utilising Openzeppelin's Clones library to considerably reduce market deployment costs.

[JTraversa]

Will review!