Blend V2 Audit + Certora Formal Verification details

• Total Audit Prize Pool: $125,000 in USDC
  • HM awards: $73,500 in USDC
  • QA awards: $2,800 in USDC
  • Judge awards: $5,000 in USDC
  • Validator awards: $3,200 in USDC
  • Scout awards: $500 in USDC
  • Mitigation Review: $20,000 in USDC
  • Formal Verification: up to $20,000 in USDC
    • Real Bug Rules: $4,000 in USDC
    • Coverage Rules: $14,000 in USDC
    • Participation Rules: $2,000 in USDC
• Read our guidelines for more details
• Starts February 24, 2025 20:00 UTC
• Ends March 17, 2025 20:00 UTC

Formal Verification pool is conditional: If no valid rules are submitted, the Formal Verification awards will be added to the HM award pool.

ℹ️ This audit includes deployed code, and the "live criticals" exception therefore applies. Please see the section titled "Live/Deployed Code" for details.

Note re: risk level upgrades/downgrades

Two important notes about judging phase risk adjustments:

• High- or Medium-risk submissions downgraded to Low-risk (QA) will be ineligible for awards.
• Upgrading a Low-risk finding from a QA report to a Medium- or High-risk finding is not supported.

As such, wardens are encouraged to select the appropriate risk level carefully during the submission phase.

Live/Deployed Code

For the purposes of the "live criticals" exception and sensitive disclosure process, contracts in the following directories should be considered live code, as they have only changed incrementally from the V1 code, which is deployed:

• ./blend-contracts-v2/pool/*
• ./blend-contracts-v2/pool-factory/*
• ./blend-contracts-v2/backstop/*

All other code in scope is not deployed. Vulnerabilities with a root cause in any part of the codebase except the above-listed directories should therefore be submitted via the standard submission form/process.

Automated Findings / Publicly Known Issues

Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.

Any issues that have already been uncovered here at the start of the contest are considered out-of-scope: https://github.com/blend-capital/blend-contracts-v2/issues

The following issues have been uncovered by the Blend team via dedicated issues in their GitHub page and should thus be considered out-of-scope:

• #18 u64 Optimization
  • The Blend team did not notice any optimizations arising from the type adjustments
• #11 Remove "spender" and "to" from "submit"
  • The Blend team decided to not implement the relevant interface changes as they believe the current approach is more readable and the flash-loan implementation that relied on this change was implemented in a different way
• #4 Simplify redundent token transfers
  • The issue of redundant token transfers is known and its implementation was considered too complex to implement at this stage

Additionally, the issue outlined below contains a lot of interesting technical information around flash-loans as well as possible known risks considered:

• #7 Add flash loans

Overview

The blend-contracts-v2 subfolder contains the smart contacts for an implementation of the Blend Protocol. Blend is a universal liquidity protocol primitive that enables the permissionless creation of lending pools.

The fee-vault subfolder represents the fee vault for Blend pools. It is used to allow an admin to collect a portion of the interest earned from blend pools by the vault depositors along with all emissions accrued by vault depositors. Wallets and integrating protocols are the entities typically interested in this functionality.

• See the Formal Verification repo README for details about the Formal Verification portion of the competition.

Links

• Previous audits: https://github.com/blend-capital/blend-contracts/tree/main/audits (V1 Audits)
• Documentation: https://docs.blend.capital/
• Website: https://www.blend.capital/
• X/Twitter: https://x.com/blend_capital
• Discord: https://discord.com/invite/a6CDBQQcjW

---

Scope

The implementations in-scope of the contest may contain unit tests defined within the code of the implementation itself. Those unit tests are clearly annotated via #[cfg(test)], #[test], or any other similar language-supported syntax and are considered out-of-scope for the purposes of the contest.

Files in scope

Files out of scope

Any file that is not explicitly included in the aforementioned list is to be considered out-of-scope.

Scoping Q & A

ERC20 token behaviors in scope

External integrations (e.g., Uniswap) behavior in scope:

EIP compliance checklist

N/A

Additional context

Main invariants

• User's cannot extract funds (borrow, withdraw) from a pool if they do not meet or exceed the minimum health factor

Attack ideas (where to focus for bugs)

Auctions

The protocol conducts auctions to both process liquidations and pay out backstop interest. Anything that can disrupt / block / break the creation or filling of these auctions has potential to impact the health of a pool and/or it's backstop.

The auction creation system was modified in v2 to allow auction creators to specify the assets in the bid/lot. https://github.com/blend-capital/blend-contracts-v2/issues/3

Flash Loans

Blend v2 introduces a flash loans endpoint. These are slightly different than EVM based flash loans, but still allow external contracts to be invoked. with borrowed funds, and repaid afterwards, or remain borrowed with the appropriate amount of collateral.

All trusted roles in the protocol

Describe any novel or unique curve logic or mathematical models implemented in the contracts:

Interest uses a capped integral controller to adjust the interest rates to help utilization reach the target utilization rate: https://docs.blend.capital/blend-whitepaper#interest-rates

Running tests

Building

Soroban Setup Prerequisites

# configure relevant rust target 
rustup target add wasm32-unknown-unknown

# install stellar cli
cargo install --locked stellar-cli@22.2.0 --features opt

To compile project (in either folder)

make

To run tests (in either folder)

make test

Miscellaneous

Employees of Blend or Certora, and employees' family members, are ineligible to participate in this audit.

Code4rena's rules cannot be overridden by the contents of this README. In case of doubt, please check with C4 staff.