FlatOperator can be inlined into NestedFactory to save gas

[code423n4]

Handle

TomFrench

Vulnerability details

Impact

Reduced gas costs from not having to load operator address from storage and make external contract call to FlatOperator

Proof of Concept

FlatOperator is going to be used on almost any operation as it's very likely that people will be investing into a portfolio using one of the tokens in that portfolio. Despite having all the information necessary to return the correct output NestedFactory has to load the FlatOperator address from storage and then make a contract call to the FlatOperator (touching an additional contract) incurring all the associated costs of this.

As the FlatOperator is such a simple and commonly used operator it's worth inlining it into NestedFactory._submitOrder and NestedFactory._safeSubmitOrder.

_submitOrder could then be modified as similarly to this:

function _submitOrder(
  address _inputToken,
  address _outputToken,
  uint256 _nftId,
  Order calldata _order,
  bool _reserved
) private returns (uint256 amountSpent) {
  uint256[] memory amounts = new uint256[](2);
  address[] memory tokens = new address[](2);
  
  // Exact method of specifying when to trigger this is up to you.
  if (_order.operator == "Flat"){
   // Extract amount from calldata (you could also remove the token address from calldata)
   (, uint256 amount) = abi.decode(_order, (address, uint256))
   
   amounts[0] = amount;
   amounts[1] = amount;
  } else {
    address operator = requireAndGetAddress(_order.operator);
    (bool success, bytes memory data) = OperatorHelpers.callOperator(operator, _order.commit, _order.callData);
    require(success, "NestedFactory::_submitOrder: Operator call failed");

    (amounts, tokens) = OperatorHelpers.decodeDataAndRequire(
      data,
      _inputToken,
      _outputToken
    );
  }
 

  if (_reserved) {
    _transferToReserveAndStore(_outputToken, amounts[0], _nftId);
  }
  amountSpent = amounts[1];
}

We then shortcut this function saving gas.

Recommended Mitigation Steps

Something similar to above snippet.

[maximebrugel]

We prefer to keep the FlatOperator for maximum modularity and readability of NestedFactory.
However, we are aware that this is a significant optimization.

[maximebrugel]

Maybe we'll do a POC and confirm later. But we will acknowledge for now.