Reserve - Mitigation Review details

• Total Prize Pool: $17,600 USDC
• Warden guidelines for C4 mitigation reviews
• Submit findings using the C4 form
• Starts September 25, 2023 20:00 UTC
• Ends September 29, 2023 20:00 UTC

Important note

Each warden must submit a mitigation review for every High and Medium finding from the parent audit that is listed as in-scope for the mitigation review. Incomplete mitigation reviews will not be eligible for awards.

Findings being mitigated

Mitigations of all High and Medium issues will be considered in-scope, with the following exceptions: M-07, M-10, M-11, M-12, M-13, M-14, and M-15. Please refer to the "Out of scope" section below for details and context on the four acknowledged / out of scope findings.

• H-01: CBEthCollateral and AnkrStakedEthCollateral _underlyingRefPerTok is incorrect
• H-02: CurveVolatileCollateral Collateral status can be manipulated by flashloan attack
• H-03: ConvexStakingWrapper.sol after shutdown，rewards can be steal
• M-01: Upgraded Q -> 2 from #26 [1693915911684]
• M-02: CTokenV3Collateral._underlyingRefPerTok should use the decimals from underlying Comet.
• M-03: RTokenAsset price estimation accounts for margin of error twice
• M-04: Possible rounding during the reward calculation
• M-05: Permanent funds lock in StargateRewardableWrapper
• M-06: CurveStableMetapoolCollateral.tryPrice returns a huge but valid high price when the price oracle of pairedToken is timeout
• M-08: User can't redeem from RToken based on CurveStableRTokenMetapoolCollateral when any underlying collateral of paired RToken's price oracle is offline(timeout)
• M-09: RTokenAsset price oracle can return a huge but valid high price when any underlying collateral's price oracle timeout

Findings acknowledged and NOT mitigated:

• M-07: The Asset.lotPrice doubles the oracle timeout in the worst case
• M-10: Asset.lotPrice only uses oracleTimeout to determine if the price is stale.
• M-11: StaticATokenLM transfer missing _updateRewards
• M-12: _claimRewardsOnBehalf() User's rewards may be lost
• M-13: Lack of protection when caling CusdcV3Wrapper._withdraw
• M-14: Lack of protection when withdrawing Static Atoken
• M-15: Potential Loss of Rewards During Token Transfers in StaticATokenLM.sol

Overview of changes

Units and price calculations in LSD collateral types were fixed.
CurveVolatileCollateral was removed entirely.
Decimals fixed in wrapped cUSDCv3.
RToken Asset pricing issues fixed, (0, FIX_MAX) enforced as "unpriced".
Reward remainder held until next claim instead of lost.

Mitigations to be reviewed

Branch

https://github.com/reserve-protocol/protocol/tree/master

Individual PRs

Wherever possible, mitigations should be provided in separate pull requests, one per issue. If that is not possible (e.g. because several audit findings stem from the same core problem), then please link the PR to all relevant issues in your findings repo.

Out of Scope