Gondi Mitigation Review

A decentralized non-custodial NFT lending protocol engineered to enable the most capital efficient loan primitive and credit market for NFTs.

  • Start date14 May 2024
  • End date24 May 2024
  • Total awards$14,600 in USDC
  • Duration10 days

Gondi Mitigation Review details

Important note

Each warden must submit a mitigation review for every individual PR listed in the Scope section below. Incomplete mitigation reviews will not be eligible for awards.

Findings being mitigated

Mitigations of all High and Medium issues will be considered in-scope and listed here.

Highs

Mediums

Overview of changes

All invidivual fixes are addressed in a separate PR. The branche feature/developWithOpt contains the merge of all such features + a few that were found by other auditors. Because of contract size issues when adding all fixes, the following has changed:

  • There's no bonus on Pool reallocation (we expect the dao to run this function and incur the cost)
  • In refinancePartial, we don't allow extra principal (this is a corner case and can still be done with addNewTranche)
  • Some of the two step variable changes in the Pool (LoanManager) have been moved to a helper contract.
    Feel free to ignore issues regarding the PoolOfferHandler since we are working on a different one given the limitations of the existing one.
  • Please note the out-of-scope item H-10. While not in scope for awards, general commentary on its design is welcome. The PR for H-12 can give some insight into it.

Scope

Branch

https://github.com/pixeldaogg/florida-contracts/pull/394

Mitigation of High & Medium Severity Issues

URLMitigation ofPurpose
https://github.com/pixeldaogg/florida-contracts/tree/fix/69H-01Only tranche lender can call mergeTranches so it assumes the responsibility.
https://github.com/pixeldaogg/florida-contracts/tree/fix/67H-02Change order in multiplication/division as suggested.
https://github.com/pixeldaogg/florida-contracts/tree/fix/64H-03Added caller check to avoid anyone calling distribute.
https://github.com/pixeldaogg/florida-contracts/tree/fix/54H-04Added tokenIdCheck
https://github.com/pixeldaogg/florida-contracts/tree/fix/50H-05Change to safeTransferFrom buyer
https://github.com/pixeldaogg/florida-contracts/tree/fix/49H-06Added loanLiquidation call
https://github.com/pixeldaogg/florida-contracts/tree/fix/48H-07Clear state vars
https://github.com/pixeldaogg/florida-contracts/tree/fix/47H-08Need to break 1 before.
https://github.com/pixeldaogg/florida-contracts/tree/fix/46H-09Missing +
https://github.com/pixeldaogg/florida-contracts/tree/fix/33H-11Passing protocol fee
https://github.com/pixeldaogg/florida-contracts/tree/fix/29H-12Added caller check
https://github.com/pixeldaogg/florida-contracts/tree/fix/28H-13Added duration check.
https://github.com/pixeldaogg/florida-contracts/tree/fix/27H-14Added nonReentrant.
https://github.com/pixeldaogg/florida-contracts/tree/fix/26H-15Strict -> <=
https://github.com/pixeldaogg/florida-contracts/tree/fix/24H-16validateOffer changed to view so validators cannot change state.
https://github.com/pixeldaogg/florida-contracts/tree/fix/13H-17Check trancheIndex to differentiate between refiFull / addNewTranche
https://github.com/pixeldaogg/florida-contracts/tree/fix/80M-01Check total tranches + min amount per tranche.
https://github.com/pixeldaogg/florida-contracts/tree/fix/76M-02Checking signature from the existing borrower.
https://github.com/pixeldaogg/florida-contracts/tree/fix/65M-03addNewTranche uses protocolFee from struct.
https://github.com/pixeldaogg/florida-contracts/tree/fix/63M-04changed to reallocate(currentBalance, principalAmount, true) instead of proposed solution (same result) to be compliant with the interface
https://github.com/pixeldaogg/florida-contracts/tree/fix/60M-05Added collectFees method
https://github.com/pixeldaogg/florida-contracts/pull/367M-06, M-07Terms must be passed in the confirm as well.
https://github.com/pixeldaogg/florida-contracts/tree/fix/51M-08Only adding a comment here. Borrower should always set block.timestamp +small time delta as expiration to control when the loan can be started.
https://github.com/pixeldaogg/florida-contracts/tree/fix/44M-09Missing collected fees in accounting
https://github.com/pixeldaogg/florida-contracts/pull/397M-10Check loanContract
https://github.com/pixeldaogg/florida-contracts/tree/fix/37M-11There's a min bid now. This + the min improvement invalidates DoS.
https://github.com/pixeldaogg/florida-contracts/tree/fix/23M-12Limit auction extensions.
https://github.com/pixeldaogg/florida-contracts/tree/fix/22M-13Proactively reallocate (we got rid of the bonus though)
https://github.com/pixeldaogg/florida-contracts/tree/fix/20M-14Corrected calculation of fees as suggested.
https://github.com/pixeldaogg/florida-contracts/tree/fix/17M-15Added check (maxDuration cannot be longer.)
https://github.com/pixeldaogg/florida-contracts/tree/fix/16M-16Changed to loan end time (instead of current timestamp)
https://github.com/pixeldaogg/florida-contracts/tree/fix/15M-17Added field in hash
https://github.com/pixeldaogg/florida-contracts/tree/fix/10M-18Always call loanManager (even if 0 proceeds)
https://github.com/pixeldaogg/florida-contracts/tree/fix/6M-19Strict to >=
https://github.com/pixeldaogg/florida-contracts/tree/fix/3M-20Set right value for getLidoData timestamp

Out of Scope

H-10 - Refinacing a loan locks the loan. Adding a tranche can only be accepted by the borrower now (H-10). External actors can only front-run a limited number of times.