Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Audit Report for StabilityBranch.sol Contract - Low Severity Issues

0xjonaseb11

Summary

external/
└── market-making/
└── branches/
└── StabilityBranch.sol

Two low-severity issues were identified regarding documentation gaps and slippage protection edge cases. These do not pose immediate threats but may lead to misunderstandings or inefficiencies.

Vulnerability Details

1. Lack of Comprehensive Documentation

  • Description: Several functions and structs lack proper NatSpec comments, reducing code maintainability.

  • Code Affected: All functions and structs.

2. Slippage Protection Edge Cases

  • Description: While slippage protection is implemented, certain edge cases (e.g., zero inputs, extremely large values) are not explicitly handled.

  • Code Affected: initiateSwap, fulfillSwap.

initiateSwap()

ctx.vaultAssetBalance = IERC20(ctx.initialVaultCollateralAsset).balanceOf(ctx.initialVaultIndexToken);
​
for (uint256 i; i < amountsIn.length; i++) {
// for all but first iteration, refresh the vault and enforce same collateral asset
if (i != 0) {
currentVault = Vault.load(vaultIds[i]);
​
// revert for swaps using vaults with different collateral assets
if (currentVault.collateral.asset != ctx.initialVaultCollateralAsset) {
revert Errors.VaultsCollateralAssetsMismatch();
}
​
// refresh current vault balance in native precision of ctx.initialVaultCollateralAsset
ctx.vaultAssetBalance = IERC20(ctx.initialVaultCollateralAsset).balanceOf(currentVault.indexToken);
}
​

fulfillSwap()

ctx.amountOut =
collateral.convertUd60x18ToTokenAmount(ctx.amountOutBeforeFeesX18.sub(ctx.baseFeeX18.add(ctx.swapFeeX18)));
​
// slippage check
ctx.minAmountOut = request.minAmountOut;
if (ctx.amountOut < ctx.minAmountOut) {
revert Errors.SlippageCheckFailed(ctx.minAmountOut, ctx.amountOut);
}
​
// calculates the protocol's share of the swap fee by multiplying the total swap fee by the protocol's fee
// recipients' share.
ctx.protocolSwapFeeX18 = ctx.swapFeeX18.mul(ud60x18(marketMakingEngineConfiguration.totalFeeRecipientsShares));
// the protocol reward amount is the sum of the base fee and the protocol's share of the swap fee
ctx.protocolReward = collateral.convertUd60x18ToTokenAmount(ctx.baseFeeX18.add(ctx.protocolSwapFeeX18));
​
// update vault debt
vault.marketsRealizedDebtUsd -= int128(ctx.amountIn);
​
// burn usd amount from address(this)
ctx.usdToken.burn(ctx.amountIn);
​
IERC20(ctx.asset).safeTransferFrom(vault.indexToken, address(this), ctx.amountOut + ctx.protocolReward);
​
marketMakingEngineConfiguration.distributeProtocolAssetReward(ctx.asset, ctx.protocolReward);
​
IERC20(ctx.asset).safeTransfer(user, ctx.amountOut);

Impact

  • Reduced maintainability due to missing documentation.

  • Unexpected behavior in rare edge cases.

Tools Used

  • Manual Code Review: Identified missing documentation.

  • Remix: Simulated edge cases.

Recommendations

  1. Add comprehensive NatSpec comments for all functions and structs.

  2. Implement explicit checks for edge cases in slippage protection logic.

  3. Perform boundary testing to verify system behavior in extreme conditions.

Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.