A Wrapped Ether implementation so efficient it'll make your teeth fall out 🦷

"METH" is an overall better version of the commonly used WETH9 contract, providing a trustless, immutable and standardized way for smart contracts to abstract away the difference between the native ETH asset and fungible ERC20 tokens.

(pending final implementation and audits)

STILL A WORK IN PROGRESS, MORE COMPARISONS PENDING

Comparison may improve in favor of METH if more optimizations are found.

This table contains a comparison of gas costs for limited function calls.

WETH9 does not have a permit method but implements a silent fallback method meaning it'll silently accept a call to all methods, even ones it hasn't implemented. This often leads to unforseen vulnerabilities when developers expect their contracts to interact with ERC20 tokens that implement certain methods or at the very least to revert if they do not implement the methods. This was e.g. the cause of Multicoin's $ 1M bridge hack.

METH does not have a silent fallback method and will revert if it's called for a method it hasn't implemented. METH does however implement a payable receive fallback method. Allowing you to wrap ETH if you explicitly send ETH to the contract along with no calldata.

The previously existing withdraw, deposit and receive fallback method behave like WETH9's methods meaning it's a drop-in replacement.

The only difference that may have to be considered: Calling methods that are not implemented will not silently pass, if you need to wrap ETH to WETH either send it directly with no calldata or use one of the deposit methods. Calling an unimplemented function may consume all gas sent to the contract.

Following (unimplemented) selectors will lead to an exceptional revert, consuming all gas when called:

0x0a000000 - 0x0affffff
0x21000000 - 0x21ffffff
0x24000000 - 0x24ffffff
0x29000000 - 0x29ffffff
0x2f000000 - 0x2fffffff
0x4b000000 - 0x4bffffff
0x86000000 - 0x86ffffff
0xaa000000 - 0xaaffffff
0xae000000 - 0xaeffffff
0xcb000000 - 0xcbffffff

Common patterns are made more efficient by packing them into single calls. Beyond saving on call overhead the methods are also more efficient because they don't need to update intermediary storage variables. Certain methods also allow contracts to avoid otherwise unused receive / payable fallback methods.

• METH.depositTo{ value: amount }(recipient); replaces:

  WETH9.deposit{ value: amount}();
  WETH9.transfer(recipient, amount);

• METH.depositAndApprove{ value: amount }(spender, amount); replaces:

  WETH9.deposit{ value: amount}();
  WETH9.approve(spender, amount);

• METH.withdrawTo(recipient, amount); replaces:

  receive() external payable {
      require(msg.sender == address(WETH));
  }
  // ...
  WETH9.withdraw(amount);
  SafeTransferLib.safeTransferETH(recipient, amount);

• METH.withdrawFrom(account, amount); replaces:

  WETH9.transferFrom(account, address(this), amount);
  WETH9.withdraw(amount);

• METH.withdrawFromTo(from, recipient, amount); replaces:

  receive() external payable {
      require(msg.sender == address(WETH));
  }
  // ...
  WETH9.transferFrom(from, address(this), amount);
  WETH9.withdraw(amount);
  SafeTransferLib.safeTransferETH(recipient, amount);

• METH.withdrawAll(); replaces:

  WETH9.withdraw(WETH9.balanceOf(address(this)));

• METH.withdrawAllTo(recipient); replaces:

  receive() external payable {
      require(msg.sender == address(WETH));
  }
  // ...
  uint amount = WETH9.balanceOf(address(this));
  WETH9.withdraw(amount);
  SafeTransferLib.safeTransferETH(recipient, amount);

METH is written directly in bytecode-level assembly using the Huff language, ensuring its implementation is as efficient as possible.

To save gas a non-standard storage layout is used:

The layout ensures minimal overhead when storing balances. The layout however also makes it possible for an allowance and balance slot to collide. Making it possible for someone to destroy WETH or mint unsusable WETH by finding an allowance slot with 12 leading zero bytes (96-bit bruteforce). For more details on the implications of this view the Security doc.

METH uses a constant gas function dispatcher that jumps to any function in its ABI in only 34-gas:

Each function verifies whether the selector matches its function selector as whole, this is done to ensure that the contract actually reverts if it's called with a selector where the identifying 8-bits match with an existing function but the full selector does not e.g. (from name()):

Due to the cost of the JUMPI opcode some functions that have more conditions defer the actual branching instruction until it can bundle together the check of multiple conditions e.g. withdraw(uint) uses only 1 JUMPI to check both the selector and that the caller has sufficient balance.