BakerFi Invitational
Delivers a cutting-edge DeFi protocol with smart staking strategies and an intuitive interface for easy maximization of returns.
- Start date20 May 2024
- End date3 Jun 2024
- Total awards$28,500 in USDC
- Duration14 days
- Details
BakerFi audit details
- Total Prize Pool: $28,500 in USDC
- HM awards: $23,040 in USDC
- QA awards: $960 in USDC
- Judge awards: $4,000 in USDC
- Scout awards: $500 in USDC
- Join C4 Discord to register
- Submit findings using the C4 form
- Read our guidelines for more details
- Starts May 20, 2024 20:00 UTC
- Ends June 3, 2024 20:00 UTC
This is a Private audit
This audit repo and its Discord channel are accessible to certified wardens only. Participation in private audits is bound by:
- Code4rena's Certified Contributor Terms and Conditions
- C4's Certified Contributor Code of Professional Conduct
All discussions regarding private audits should be considered private and confidential, unless otherwise indicated.
Automated Findings / Publicly Known Issues
The 4naly3er report can be found here.
Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.
Overview
BakerFi is a fully non-custodial application for managing leveraged staking strategies in various DeFi lending protocols to amplify generated by usersโ assets (ETH, DAI, GHO, among others).
BakerFi stands out as a unique product with a distinctive approach to the market. It employs singular strategies designed to empower any regular user to execute sophisticated and well-orchestrated DeFi strategies, optimizing returns on their capital. The product achieves this through two key pillars.
Firstly, it simplifies the intricate configurations essential for deploying DeFi strategies, abstracting them from the end user and ensuring ease of use, even for those with limited experience in DeFi.
Orchestrating a lucrative DeFi strategy requires some deep research and some level of expertise to make it successful.
Secondly, it deploys strategies using global configurations, controlled by protocol, thereby reducing user risks and minimizing their exposure to market turmoils and black-swan scenarios. ๐ฆข
Bakerfi Smart Contracts
Recursive ETH Staking made easy, amplify your yields with recursive based strategies based on lending markets (AAVE v3, ...) and flash loans.
Features
- Pool Based Yield Generation
- Liquidation Protection
- Easy to Use Interface
- Leverage based on Flash Loans
- Liquid Yield Shares matETH
- Proxied Deployment for Settings, Vault and Strategies
Integrations
- AAVE v3
- Lido Staking Contracts
- Uniswap v3
- Balancer Flash Loans
Links
- Previous audits: https://github.com/code-423n4/2024-05-bakerfi/blob/main/audits/audit-creed-2024-05-10.pdf
- Documentation: https://github.com/code-423n4/2024-05-bakerfi/tree/main/doc
- Website: https://bakerfi.xyz/
- X/Twitter: https://twitter.com/bakerfi_
- Discord: https://dub.sh/bakerfi-discord
Scope
See scope.txt
Files in scope
| File | Logic Contracts | Interfaces | SLOC | Purpose | Libraries used |
|---|---|---|---|---|---|
| /contracts/core/Constants.sol | **** | **** | 6 | ||
| /contracts/core/GovernableOwnable.sol | 1 | **** | 27 | @openzeppelin/contracts-upgradeable/access/OwnableUpgradeable.sol | |
| /contracts/core/ServiceRegistry.sol | 1 | **** | 49 | @openzeppelin/contracts/access/Ownable.sol | |
| /contracts/core/Settings.sol | 1 | **** | 97 | @openzeppelin/contracts-upgradeable/access/Ownable2StepUpgradeable.sol<br>@openzeppelin/contracts/utils/structs/EnumerableSet.sol | |
| /contracts/core/Vault.sol | 1 | **** | 172 | @openzeppelin/contracts-upgradeable/access/Ownable2StepUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/security/PausableUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/utils/SafeERC20Upgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/extensions/ERC20PermitUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/utils/AddressUpgradeable.sol | |
| /contracts/core/flashloan/BalancerFlashLender.sol | 1 | **** | 83 | @openzeppelin/contracts/token/ERC20/IERC20.sol<br>@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol<br>@openzeppelin/contracts-upgradeable/interfaces/IERC3156FlashLenderUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/interfaces/IERC3156FlashBorrowerUpgradeable.sol | |
| /contracts/core/governance/BKR.sol | 1 | **** | 29 | @openzeppelin/contracts/token/ERC20/ERC20.sol<br>@openzeppelin/contracts/access/Ownable.sol<br>@openzeppelin/contracts/token/ERC20/extensions/ERC20Permit.sol<br>@openzeppelin/contracts/token/ERC20/extensions/ERC20Votes.sol | |
| /contracts/core/governance/BakerFiGovernor.sol | 1 | **** | 86 | @openzeppelin/contracts/governance/Governor.sol<br>@openzeppelin/contracts/governance/compatibility/GovernorCompatibilityBravo.sol<br>@openzeppelin/contracts/governance/extensions/GovernorVotes.sol<br>@openzeppelin/contracts/governance/extensions/GovernorVotesQuorumFraction.sol<br>@openzeppelin/contracts/governance/extensions/GovernorTimelockControl.sol | |
| /contracts/core/governance/Timelock.sol | 1 | **** | 9 | @openzeppelin/contracts/governance/TimelockController.sol | |
| /contracts/core/hooks/UseAAVEv3.sol | 1 | **** | 22 | @openzeppelin/contracts/token/ERC20/IERC20.sol<br>@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/hooks/UseFlashLender.sol | 1 | **** | 21 | @openzeppelin/contracts-upgradeable/interfaces/IERC3156FlashLenderUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/hooks/UseIERC20.sol | 1 | **** | 19 | @openzeppelin/contracts/token/ERC20/IERC20.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/hooks/UseLeverage.sol | 1 | **** | 51 | ||
| /contracts/core/hooks/UseOracle.sol | 1 | **** | 22 | @openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/hooks/UseSettings.sol | 1 | **** | 19 | @openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/hooks/UseStETH.sol | 1 | **** | 19 | @openzeppelin/contracts/token/ERC20/IERC20.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/hooks/UseStrategy.sol | 1 | **** | 19 | @openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/hooks/UseSwapper.sol | 1 | **** | 75 | @openzeppelin/contracts/token/ERC20/IERC20.sol<br>@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/hooks/UseUniQuoter.sol | 1 | **** | 19 | @openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/hooks/UseWETH.sol | 1 | **** | 27 | @openzeppelin/contracts/token/ERC20/IERC20.sol<br>@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/hooks/UseWstETH.sol | 1 | **** | 36 | @openzeppelin/contracts/token/ERC20/IERC20.sol<br>@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/strategies/StrategyAAVEv3.sol | 1 | **** | 73 | @openzeppelin/contracts/token/ERC20/IERC20.sol<br>@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol<br>@openzeppelin/contracts-upgradeable/utils/AddressUpgradeable.sol | |
| /contracts/core/strategies/StrategyAAVEv3WSTETH.sol | 1 | **** | 59 | @openzeppelin/contracts-upgradeable/token/ERC20/IERC20Upgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/utils/SafeERC20Upgradeable.sol<br>@openzeppelin/contracts-upgradeable/utils/AddressUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | |
| /contracts/core/strategies/StrategyLeverage.sol | 1 | **** | 378 | @openzeppelin/contracts-upgradeable/interfaces/IERC3156FlashBorrowerUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/IERC20Upgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/utils/SafeERC20Upgradeable.sol<br>@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/utils/AddressUpgradeable.sol | |
| /contracts/core/strategies/StrategyLeverageSettings.sol | 1 | **** | 52 | ||
| /contracts/libraries/RebaseLibrary.sol | 1 | **** | 35 | ||
| /contracts/oracles/EthOracle.sol | 1 | **** | 26 | ||
| /contracts/oracles/PythOracle.sol | 1 | **** | 50 | ||
| /contracts/oracles/WstETHToETHOracle.sol | 1 | **** | 26 | ||
| /contracts/oracles/WstETHToETHOracleETH.sol | 1 | **** | 32 | ||
| /contracts/oracles/cbETHToETHOracle.sol | 1 | **** | 27 | ||
| /contracts/proxy/BakerFiProxy.sol | 1 | **** | 9 | @openzeppelin/contracts/proxy/transparent/TransparentUpgradeableProxy.sol | |
| /contracts/proxy/BakerFiProxyAdmin.sol | 1 | **** | 9 | @openzeppelin/contracts/proxy/transparent/ProxyAdmin.sol | |
| Totals | 32 | **** | 1683 |
Files out of scope
See out_of_scope.txt
| File |
|---|
| ./contracts/interfaces/aave/v3/DataTypes.sol |
| ./contracts/interfaces/aave/v3/IPoolAddressesProvider.sol |
| ./contracts/interfaces/aave/v3/IPoolV3.sol |
| ./contracts/interfaces/balancer/IFlashLoan.sol |
| ./contracts/interfaces/balancer/IProtocolFeesCollector.sol |
| ./contracts/interfaces/balancer/IVault.sol |
| ./contracts/interfaces/chainlink/IChainlinkAggregator.sol |
| ./contracts/interfaces/core/IOracle.sol |
| ./contracts/interfaces/core/IServiceRegistry.sol |
| ./contracts/interfaces/core/ISettings.sol |
| ./contracts/interfaces/core/IStrategy.sol |
| ./contracts/interfaces/core/ISwapHandler.sol |
| ./contracts/interfaces/core/IVault.sol |
| ./contracts/interfaces/curve/ICurvePool.sol |
| ./contracts/interfaces/lido/IStETH.sol |
| ./contracts/interfaces/lido/IWStETH.sol |
| ./contracts/interfaces/pyth/IPyth.sol |
| ./contracts/interfaces/pyth/IPythEvents.sol |
| ./contracts/interfaces/pyth/PythStructs.sol |
| ./contracts/interfaces/tokens/IWETH.sol |
| ./contracts/interfaces/uniswap/v3/IQuoterV2.sol |
| ./contracts/interfaces/uniswap/v3/ISwapRouter.sol |
| ./contracts/interfaces/uniswap/v3/IUniswapV3Pool.sol |
| ./contracts/mocks/AAVE3PoolMock.sol |
| ./contracts/mocks/BalancerVaultMock.sol |
| ./contracts/mocks/BorrowerAttacker.sol |
| ./contracts/mocks/ERC20Mock.sol |
| ./contracts/mocks/ERC3156FlashBorrowerMock.sol |
| ./contracts/mocks/ERC3156FlashLender.sol |
| ./contracts/mocks/OracleMock.sol |
| ./contracts/mocks/PythMock.sol |
| ./contracts/mocks/QuoterV2Mock.sol |
| ./contracts/mocks/SettingsV2.sol |
| ./contracts/mocks/StrategyLeverageSettingsMock.sol |
| ./contracts/mocks/StrategyMock.sol |
| ./contracts/mocks/UniV3RouterMock.sol |
| ./contracts/mocks/WETH.sol |
| ./contracts/mocks/WstETH.sol |
| ./contracts/tests/BoringRebaseTest.sol |
| ./contracts/tests/RebaseLibraryTest.sol |
| ./contracts/tests/VaultFuzzing.sol |
| Totals: 41 |
Scoping Q & A
General questions
| Question | Answer |
|---|---|
| ERC20 used by the protocol | Any (all possible ERC20s) WETH, USDC, USDT, RETH, STETH, WSETH |
| Test coverage | Lines: 78,85%, Functions: 60,47% |
| ERC721 used by the protocol | None |
| ERC777 used by the protocol | None |
| ERC1155 used by the protocol | None |
| Chains the protocol will be deployed on | Arbitrum,Optimism,Base,Ethereum |
ERC20 token behaviors in scope
External integrations (e.g., Uniswap) behavior in scope:
| Question | Answer |
|---|---|
| Enabling/disabling fees (e.g. Blur disables/enables fees) | Yes |
| Pausability (e.g. Uniswap pool gets paused) | No |
| Upgradeability (e.g. Uniswap gets upgraded) | No |
EIP compliance checklist
None
Additional context
Main invariants
-
Only the Governor should be able to update Global Settings
-
Only the Governorwer should be able to update the Strategy Settings
-
Only the Vault should be able to call Strategy's
deploy,undeployandharvestfunctions -
No external user should access have control of the strategy funds.
-
Only the owner of Vault shares can burn its shares to withdraw funds from the strategy.
-
It is not possible to mint new shares without depositing ETH on the vault
Attack ideas (where to focus for bugs)
-
Vault Share Inflation and Deflation attacks.
-
Manipulated Withdraws.
All trusted roles in the protocol
| Role | Description |
|---|---|
| Governor | The entity that is able to update the proxy implementations and change the strategy parameters, and global settings. In the future the governor is going to be the protocol dao. |
| User | Able to deposit, withdraw and call the liquidation protection mechanism (rebalance). |
Any novel or unique curve logic or mathematical models implemented in the contracts:
None
Running tests
git clone https://github.com/code-423n4/2024-05-bakerfi.git git submodule update --init --recursive cd 2024-05-bakerfi npm install npx hardhat compile npm run test
To run code coverage
npm run test:coverage
To run gas benchmarks
npm run test:gas
Prerequisites
Before getting started with this project, make sure you have the following prerequisites:
- Node.js (version 18 or higher)
- NPM (version 9.0 or higher)
- Hardhat (version 2.0.0 or higher)
- Ethereum wallet or provider (e.g., MetaMask)
- Solidity development knowledge
Installation
- Clone the project repository to your local machine:
git clone https://github.com/code-423n4/2024-05-bakerfi.git
- Navigate to the project directory:
cd 2024-05-bakerfi
- Install the dependencies:
npm install
Usage
Compiling Smart Contracts
To compile the smart contracts, run the following command:
npx hardhat compile
The compiled artifacts will be placed in the ./artifacts directory.
Running Tests
To run the automated tests, execute the following command:
npm run test
# With Gas Report
npm run test:gas
# With Gas Report + Test Coverage
npm run test:coverage
This will execute the tests defined in the ./test directory.
Deployment
To deploy your smart contracts to a specific network, configure the network settings in the hardhat.config.js file. Then, run the deployment script using the following command:
Production
npx hardhat run --network <network-name> scripts/deploy.ts
Local Development (Ganache)
# Open a terminal to run Ganache
npm run ganache:dev
# Open a separate terminal to run the deployment script
npx hardhat run scripts/deploy-dev.ts
Replace <network-name> with the desired network from your configuration.
Create an SDK packager
npm run compile:clean && npm run build
npm pack
Setup Development Environment
- Start ganache with the predefined accounts
npm run ganache:dev
This will start a local Ethereum network with accounts pre-loaded with test Ether. The server will output the available accounts and their private keys.
- Deploy the Vault Contract with Mocks Deployed
npm run deploy:local
If everything runs sucessfully you should get Bakerfi Vault deployed with some mocked Services for testing purposes
Service Registry = 0x37ebdd9B2adC5f8af3993256859c1Ea3BFE1465e
WETH = 0xd7630A747b24b7245ff60e3095aD04684dC1a292
FlashLender Mock = 0x5Ac32814f9EB4d415779892890a216b244FcB3B5
stETH = 0x2C263d29775dC27167c58aB7B18dc6C942c141B0
wstETH = 0x27F56eb75a1EBbE7e7218e8fCa5FF51E3d655f22
Swap Router Mock = 0x26A76D21edD8049fd394786976EF578010569FcB
AAVE v3 Mock = 0x621e8cdBc878Bdda95d0247B71FeBE0a8b2d4EE3
BakerFi Vault = 0xE8A1e868E4736669b73B9E26BE22129bD6B4E83d
BakerFi Vault AAVEv3 Strategy = 0xC5Dfa3ebaDD8cf122b2b086e3aC28492Da76a0eE
WSETH/ETH Oracle = 0xE8F362bF1E066547113981FdaC7c1dDC6949a7Ac
Development CLI Commands
Get the Network Deployment Addresses
#HARDHAT_NETWORK=base_devnet npx ts-node --files scripts/cli.ts contracts <serviceRegistryAddress>
HARDHAT_NETWORK=base_devnet npx ts-node --files scripts/cli.ts contracts 0xE8A1e868E4736669b73B9E26BE22129bD6B4E83d
Interacting with Contracts
You can interact with the deployed contracts using the Hardhat console. Start the console with the following command:
npx hardhat console --network <network-name>
Replace <network-name> with the desired network from your configuration.
Usefull Scripts
Export Flat File Contracts
npm run export:flat
Generate Documentation
npm run doc
Run Echidna for Testing
echidna . --config echidna.yaml --contract VaultFuzzing
Verify a contract
npx hardhat verify --network mainnet <contract_address> <args>...
Miscellaneous
Employees of BakerFi and employees' family members are ineligible to participate in this audit.