Salty.IO Mitigation Review

Salty.IO is an Ethereum-based DEX with zero swap fees, yield-generating Automatic Arbitrage, a native WBTC/WETH backed stablecoin, and is fully DAO owned and decentralized at launch.

  • Start date1 Mar 2024
  • End date11 Mar 2024
  • Total awards$30,000 in USDC
  • Duration10 days

Salty.IO - Mitigation Review details

Important note

Each warden must submit a mitigation review for every High and Medium finding from the parent audit that is listed as in-scope for the mitigation review along with the Additional Scope to be Reviewed section. Incomplete mitigation reviews will not be eligible for awards.

Findings being mitigated

Mitigations of all High and Medium issues will be considered in-scope and listed here.

Overview of changes

To decrease the risk profile of the exchange and focus on the core features provided by automatic arbitrage, the USDS stablecoin and all associated functionality (price feeds, collateral, liquidizer, etc) have been completely removed. The stablecoin was largely isolated from the rest of the project, but this did refactor the way Upkeep works.

Resulting from the stablecoin being removed all tokens are now paired with WETH and USDC rather than WETH and WBTC (which was previously done to provide increased yield for now removed collateral).

Also, the ManagedWallet contract has been removed - with the teamVestingWallet now targeting a simple teamWallet address.

To prevent any swaps from occurring during performUpkeep, Protocol Owned Liquidity has been removed. Additionally, on user swap any WETH profits that are generated are swapped immediately to SALT - rather than being done in performUpkeep.

In response to a suggestion by one of the wardens in the original competition, the ArbitrageSearch mechanism has been refactored and optimized extensively:
https://github.com/code-423n4/2024-01-salty-findings/issues/419

Users are now limited to one swap per block due to an issue found in which arbitrage could be bypassed by dividing up individual swaps into tens or hundreds of swaps. Without the limitation and due to the protocol's reletively low gas costs for swap and arbitrage, attackers would otherwise be able to perform multiple swaps in one transaction - effectively bypassing arbitrage and the rebalancing done that discourages manipulation. While multiple wallets could still be used on such an attack, the gas costs incurred on the multiple separate swap transactions are considered a sufficient deterrent.

Mitigations to be reviewed

URLMitigation ofPurpose
https://github.com/othernet-global/salty-io/commit/5766592880737a5e682bb694a3a79e12926d48a5H-01ManagedWallet has been removed. VestingWallet now just vests directly to teamWallet.
https://github.com/othernet-global/salty-io/commit/4f0c9c6a6e3e4234135ab7119a0e380af3e9776cH-02performUpkeep is now called at the start of BootstrapBallot.finalizeBallot to reset the emissions timers just before liquidity rewards claiming is started.
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edH-03The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/5f79dc4f0db978202ab7da464b09bf08374ec618H-04virtualRewards and userShare are now uint256 rather than uint128.
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edH-05The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edH-06The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/b3b8cb955db2b9f0e47a4964e1e4f833a447a72dM-01virtualRewards now rounded up on _decreaseUserShare
https://github.com/othernet-global/salty-io/commit/5f1a5206a04b0f3fe45ad88a311370ce12fb0135M-02callFromDAO now wrapped in a try/catch
https://github.com/othernet-global/salty-io/commit/ccf4368fcf1777894417fccd2771456f3eeaa81cM-03There is now no limit to the number of tokens that can be proposed for whitelisting. Also, any whitelisting proposal that has reached quorum with sufficient approval votes can be executed.
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edM-04The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edM-05The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/758349850a994c305a0ab9a151d00e738a5a45a0M-06ballotMaximumDuration added. There is now a default 30 day period after which ballots can be removed by any user.
https://github.com/othernet-global/salty-io/commit/5766592880737a5e682bb694a3a79e12926d48a5M-07ManagedWallet has been removed.
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edM-08The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/b01f6e5cb360e89f9e4cdae41d609ea747bcaa86M-09Fixes reserves DUST check
https://github.com/othernet-global/salty-io/commit/c46069644739885fa36e84e27e1dd6362b854663M-11Ballots now keep track of their own requiredQuorum at the time they were created.
https://github.com/othernet-global/salty-io/commit/39921b4a25041c7ac4e9b5279e12bb2ec518140bM-12ballotNames now include all provided proposal arguments.
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edM-13The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/ccf4368M-14Removed maxPendingTokensForWhitelisting. There is now no limit to the number of tokens that can be proposed for whitelisting. Also, any whitelisting proposal that has reached quorum with sufficient approval votes can be executed.
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edM-15The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/a54656dd18135ca57eef7c4bf615b7cdff2613a7 https://github.com/othernet-global/salty-io/commit/53feaeb0d335bd33803f98db022871b48b3f2454M-16ArbitrageSearch updated as suggested with MSB as well
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edM-18The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/758349850a994c305a0ab9a151d00e738a5a45a0M-19There is now a default 30 day period after which ballots can be removed by any user.
https://github.com/othernet-global/salty-io/commit/eaf40ef0fa27314c6e674db6830990df68e5d70eM-20POL has been removed from the protocol
https://github.com/othernet-global/salty-io/commit/eaf40ef0fa27314c6e674db6830990df68e5d70eM-21POL has been removed from the protocol
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edM-22The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/44320a8cc9b94de433e437e025f072aa850b995aM-25Zapping no longer uses scaling.
https://github.com/othernet-global/salty-io/commit/eaf40ef0fa27314c6e674db6830990df68e5d70eM-26POL has been removed from the protocol
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edM-27The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/0bb763cc67e6a30a97d8b157f7e5954692b3dd68M-28minAddedAmountA and minAddedAmountB are now used.
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edM-29The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/8e3231d3f444e9851881d642d6dd03021fade5edM-30The stablecoin framework has been removed: /stablecoin, /price_feed, WBTC/WETH collateral, PriceAggregator, price feeds and USDS.
https://github.com/othernet-global/salty-io/commit/5766592880737a5e682bb694a3a79e12926d48a5M-31ManagedWallet has been removed.

Additional scope to be reviewed

Individual PRs

These are additional changes that will be in scope and were addressed outside of direct mitigation. (EXTRA Scoope)

Out of Scope

Please list any High and Medium issues that were judged as valid but you have chosen not to fix.
M-10
M-17
M-23
M-24