Secured Finance
Quantstamp reviewed Secured Finance on 12 Dec 2023: 45 findings, 0 critical; 23 marked fixed, 17 acknowledged, 5 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings45
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 4 |
| Medium | 1 | 3 | 6 |
| Low | 4 | 14 | 13 |
MediumCurrencies Can Be Unregistered From `TokenVault`, Which Could Lead to Funds LockedOpen
Several functions in the contract `TokenVault` only accept to work for currencies registered in the mapping `tokenAddresses`, based on the modifier `onlyRegisteredCurrency()`. The owner of the contract can register new currencies via the function `registerCurrency()`. Only currencies with an existing identifier registered in the contract `CurrencyController` can be registered. However, it is possible to unregister a currency by setting it to the `address(0)`. This can lead to: 1. The owner can call this function with the wrong address, halting the deposit and withdrawal system of the protocol. All transfer calls to this wrong address will revert. 2. The address passed can be different from the one listed in `CurrencyController`. 3. Duplicated `CurrencyRegistered` events.
LowEvents Emitted Even if No Update Is PerformedOpen
1. The function `MixinAddressResolver.buildCache()` can be called by anyone to update the addresses associated with the required contract names used by the contract. An event `CacheUpdated` is emitted for each required contract, whether it is updated or not. This could result in more events emitted than required. 2. The function `MixinWallet.executeTransactions()` can be called by the owner of the contract. It results in the emission of an event `TransactionsExecuted` even if no transaction has been executed.
LowMissing Input ValidationOpen
It is important to validate inputs, even if they only come from trusted addresses, to avoid human error: 1. `BeaconProxyController`: verify the value of `LendingMarket.MINIMUM_RELIABLE_AMOUNT_IN_BASE_CURRENCY` when the contract becomes the implementation contract of the beacon. 2. `LendingMarketOperationLogic.createOrderBook()`: verify that the duration between `_preOpeningDate` and `_openingDate` is short enough to avoid locking tokens by placing pre-orders. 3. qs-badge-fixed `MixinLiquidationConfiguration._updateLiquidationConfiguration()`: verify that the value of `_liquidationThresholdRate` is higher than `Constants.PCT_DIGIT` to prevent the under-collateralization of the protocol. 4. qs-badge-fixed `LendingMarketController.initializeLendingMarket()`: verify the correctness of the values used as parameters.
LowPartial Imports of Addresses in `AddressResolver` Are PossibleOpen
The function `importAddresses()` can be called by the owner of the contract to update the mapping of a list of addresses with new names. Such action will also result in the update of the storage list `addressCaches`. However, this function can be called several times and maintain previous mapping associations valid. For instance: 1. Owner calls the function with `_names = ["A", "B"]` and `_addresses = [0x01,0x02]`. The mapping `addresses` is updated accordingly and `addressCaches` takes the value of `_addresses`. 2. Owner calls again the function with `_names = ["A"]` and `_addresses = [0x03]`. The mapping `addresses` is updated accordingly and `addressCaches` takes the value of `_addresses`. 3. After the operation: * `addressCaches` is `[0x03]`; * `addresses["A"] = 0x03`'; * `addresses["B"] = 0x02`'; This could lead to storage inconsistencies between what is stored in the mapping `addresses` and the list `addressCaches` and ultimately to broken assumptions about the system if the function `importAddresses()` is called with inconsistent parameters. Also, duplicate items are possible in both lists (`_names` and `_addresses`). Having duplicates could result in unexpected mapping associations and duplicates in the list `addressCaches`.
LowThe Libraries `FullMath`, `RoundingInt256`, and `RoundingUint256` Can Revert Due to OverflowsOpen
1. The function `FullMath.mulDiv()` overflows when `a * b > type(uint256).max`. Note that an implementation of the same algorithm by Open Zeppelin uses an `unchecked` block for the whole function: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/769071d47366addc20e160bce53a6dd480d5f89d/contracts/utils/math/Math.sol#L124. 2. The function `RoundingInt256.div()` overflows when `a x 10 > type(int256).max` and underflows when `a x 10 < type(int256).min`. 3. The function `RoundingUint256.div()` overflows when `a x 10 > type(uint256).max`. However, we assessed that it was unlikely to use these functions with such values for `a` and `b`.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (70)
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/BokkyPooBahsDateTimeLibrary.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/math/RoundingUint256.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/libraries/TransferHelperStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IBeaconProxyController.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/LendingMarketUserLogic.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/utils/PausableStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/FutureValueVaultStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/BeaconProxyController.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/utils/OwnableStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/TokenVault.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/LendingMarketOperationLogic.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/utils/Proxyable.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/OrderBookLib.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/INativeToken.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/OrderStatisticsTreeLib.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/GenesisValueVault.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/utils/Pausable.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/mixins/MixinWallet.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/utils/UpgradeableBeacon.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/utils/Ownable.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/BeaconProxyControllerStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/mixins/MixinAddressResolver.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/CurrencyController.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/mixins/MixinAddressResolverStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/ICurrencyController.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/ProxyController.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/AddressResolver.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/mixins/MixinAccessControl.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/ILendingMarketController.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IReserveFund.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/utils/LockAndMsgSender.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/utils/AccessControl.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/DepositManagementLogic.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/GenesisValueVaultStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IGenesisValueVault.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/TokenVaultStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/math/RoundingInt256.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/LendingMarket.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/ILendingMarket.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/OrderReaderLogic.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/CurrencyControllerStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/types/ProtocolTypes.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/LendingMarketStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/mixins/MixinLiquidationConfiguration.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IFutureValueVault.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/Contracts.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/mixins/MixinLendingMarketConfiguration.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/ReserveFund.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/FundManagementLogic.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IProxyController.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/migration/MigrationAddressResolver.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/ILiquidationReceiver.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/TransferHelper.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/math/FullMath.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/ReserveFundStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/AddressResolverLib.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/FutureValueVault.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/QuickSort.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/LendingMarketControllerStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/AddressResolverStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/OrderActionLogic.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/OrderBookLogic.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/utils/UpgradeabilityBeaconProxy.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/utils/UpgradeabilityProxy.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/ITokenVault.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/LiquidationLogic.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IAddressResolver.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/Constants.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/storages/utils/AccessControlStorage.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
- https://github.com/Secured-Finance/contracts/contracts/protocol/LendingMarketController.sol at commit 92f4e85370f2804438e08995ab9199ad137805d3
Part of Secured Finance’s security record
Secured FinanceSecurity firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us