LoopFi audit details

• Total Prize Pool: $25,000 in USDC
  • HM awards: $21,000 in USDC
  • Judge awards: $2,300 in USDC
  • Validator awards: $1,200 USDC
  • Scout awards: $500 in USDC
• Read our guidelines for more details
• Starts October 10, 2024 20:00 UTC
• Ends October 17, 2024 20:00 UTC

ℹ️ While there are no QA awards, QA reports are encouraged as a fallback in the event of no valid HMs.

Automated Findings / Publicly Known Issues

The 4naly3er report can be found here.

Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.

Overview

Loop is a decentralized finance (DeFi) platform designed to optimize yield distribution among participants through innovative lending, borrowing, and staking mechanisms.

This is a flow diagram of the Loop DeFi system:

The platform's core concept revolves around leveraging ETH-based yields, utilizing receipt tokens, and staking mechanisms to align incentives between various actors:

• Lenders: Receive lpETH tokens in exchange for ETH deposits, which can be further staked to earn passive yield in ETH.
• Borrowers (Loopers): Can borrow ETH against yielding LRT derivatives to engage in carry trades and optimize returns on ETH-based yields.
• dLP Lockers: Lock the governance token LOOP into a Dynamic Liquidity Position (dLP) to earn protocol revenue.
• Interest Rebates: Loopers can offset borrow costs by locking 5% of their Total Looped Position Size in the dLP, effectively receiving rebates on interest paid.

Core Smart Contracts

1. CDPVault

The CDPVault contract manages the core logic of the borrowing and lending functionalities. It allows users to deposit collateral, borrow against it, and handle repayments.

Public Interface:

• deposit(address to, uint256 amount): Deposits collateral tokens into the vault.
• withdraw(address to, uint256 amount): Withdraws collateral from the vault.
• borrow(address borrower, address position, uint256 amount): Borrows ETH against collateral.
• repay(address borrower, address position, uint256 amount): Repays borrowed ETH.

Liquidity Management:
The CDPVault utilizes PoolV3 for liquidity management. The liquidity pool facilitates lending and borrowing activities, managing deposits, withdrawals, and interest accruals.

Interaction with PoolV3:

• Borrowing: The CDPVault borrows from PoolV3 against the deposited collateral and the available liquidity.
• Repayments: Repayments to the vault are forwarded to PoolV3, updating the total debt and interest accordingly.

2. PoolV3

PoolV3 is a contract that provides a liquidity pool for the CDPVault. It handles the aggregation of funds, debt management, and distribution of interest among liquidity providers.

Key Functions:

• deposit(uint256 assets, address receiver): Allows underlying asset deposits into the pool.
• withdraw(uint256 assets, address receiver, address owner): Withdraws the specified amount from the pool.
• lendCreditAccount(uint256 borrowedAmount, address creditAccount): Facilitates lending to credit accounts.
• repayCreditAccount(uint256 repaidAmount, uint256 profit, uint256 loss): Handles repayments and adjusts the pool's state accordingly.

3. Treasury

The Treasury contract manages protocol revenues, distributing fees generated by the CDPVault and PoolV3 among stakeholders, including dLP lockers and ETH stakers.

4. StakingLPEth

The StakingLPEth contract allows lpETH holders to stake their tokens and earn passive yield in ETH.

5. FlashLender

The FlashLender contract enables leveraging positions and executing flash loans.

Auxiliary Contracts

The Loop protocol provides a set of auxiliary contracts to enhance user experience and flexibility. These contracts work in conjunction with the core contracts, enabling complex interactions and optimizations.

Action Contracts

Action contracts facilitate the bundling of multiple transactions into a single contract interaction, allowing users to efficiently manage their positions and leverage within the protocol.

• PoolAction: Facilitates interactions with the pool, such as deposits and withdrawals.
• PositionAction: Bundles transactions related to the CDPVault, allowing users to leverage positions by performing multiple actions in a single transaction.
• Swap and Transfer Actions: Provide wrappers over swapping and transferring functionalities, enabling users to perform these actions seamlessly within the protocol.

Oracle Contracts

The protocol uses robust and trustworthy price feeds powered by Chainlink. These Oracle contracts ensure reliable and accurate asset pricing, which is critical for maintaining the integrity of the system.

• Price Feeds: The Oracle contracts fetch asset prices using Chainlink, providing secure and decentralized data feeds for the protocol.

Links

• Previous audits:
  • Report #1
  • Report #2
  • Report #3
  • Report #4
  • Report #5
  • Code4rena audit: July 2024 - preliminary report - see notes below
• Documentation
• Website
• X/Twitter
• Discord

Previous Code4rena audit

Code4rena conducted a competitive audit on an earlier version of LoopFi's codebase between July 25 - August 15, 2024. Judging has not yet been finalized for that audit; however, a preliminary report is linked above. The preliminary audit report presents the findings currently under review in that audit. All findings are subject to change as judging proceeds. A final report will be published when judging is finalized.

---

Scope

See scope.txt

Files in scope

Files out of scope

See out_of_scope.txt

Scoping Q & A

General questions

External integrations (e.g., Uniswap) behavior in scope:

EIP compliance checklist

N/A

Additional context

Main invariants

Debt >= Borrowed

Attack ideas (where to focus for bugs)

Verify fixes from the first contest and audit the newly added contracts:

• src/Locking.sol
• src/Treasury.sol
• src/pendle-rewards/RewardManager.sol
• src/pendle-rewards/RewardManagerAbstract.sol

All trusted roles in the protocol

Describe any novel or unique curve logic or mathematical models implemented in the contracts:

N/A

Running tests

git clone --recurse https://github.com/code-423n4/2024-10-loopfi.git
cd 2024-10-loopfi
cp example.env .env

# Fill the MAINNET_RPC_URL field with your own Alchemy RPC URL in the .env file (or try to use a public one like https://eth.llamarpc.com)

forge install
forge test
forge coverage

coverage

Miscellaneous

Employees of LoopFi and employees' family members are ineligible to participate in this audit.

Code4rena's rules cannot be overridden by the contents of this README. In case of doubt, please check with C4 staff.