Overview
- About C4
- Wardens
Summary
Scope
Severity Criteria
High Risk Findings (3)
Medium Risk Findings (9)
Low Risk Findings (18)
- [L-01] Missing checks on debt max/min limits could cause pour to revert
- [L-02] Return values of batch operations are ignored
- [L-03] Missing sender address check in receive() may lead to locked Ether
- [L-04] Missing reentrancy guard and contract existence check for modules
- [L-05] Prevent the use of LOCK in setRoleAdmin to instead force the use of lockRole
- [L-06] Incompatibility With Rebasing/Deflationary/Inflationary tokens
- [L-07] flashFeeFactor is uninitialized at declaration leading to zero-fee flash loans enabled by default
- [L-08] Multiple compiler versions allowing a wide range from 0.5.0 to >=0.8.0
- [L-09] Anyone can create a fake pool to trick unauthorized front-ends
- [L-10] In method _update on Pool.sol - Divide before multiply
- [L-11] Implicit unsafe math
- [L-12] Unsafe call to .decimals
- [L-13] _burnInternal always returns 0 for fy tokens returned
- [L-14] ERC20 approve is vulnerable to the front-running
- [L-15] external function transferToPool is pretty useless
- [L-16] function redeem should return “redeemed” amount
- [L-17] Using stale cToken exchange rate
- [L-18] Missing zero-address validations
Non-Critical Findings (12)
- [N-01] Use .selector instead of hex number
- [N-02] PoolFactory and JoinFactory very similar
- [N-03] Avoid assembly in getRevertMsg
- [N-04] Use constants for numbers
- [N-05] Several todos left in the code
- [N-06] Useless auth modifier in setSources
- [N-07] enum TokenType is never used
- [N-08] no need for transferToPoolto be payable
- [N-09] UniswapV3Oracle function _peek is public
- [N-10] function build could explicitly check that seriesId is not 0
- [N-11] Unnecessary unchecked keyword is used in FYToken
- [N-12] Constants “chi” and “rate”
Gas Optimizations
Disclosures

Yield contest