Altitude

OXORIO16 Jul 2024Files named in the report

OXORIO reviewed Altitude on 16 Jul 2024: 37 findings, 1 critical; 23 marked fixed, 14 acknowledged.

1 critical finding, fixed

Open the report Open Altitude’s security record

Report hosted on audits.oxor.io.

Trustblock does not review code.

Findings37

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	1
High	0	3	3
Medium	0	7	8
Low	0	4	11

CriticalWithdrawal without considering loan interest creates bad debt in InterestTokenFixed

The report gives no description here.

HighAbsence of whitelist allows injection and distribution of "dirty" cryptocurrency in HarvestableManagerFixed

The report gives no description here.

HighExcessive debt repayment locks liquidation process in LiquidatableManagerFixed

The report gives no description here.

HighZero debt size sets interestIndex to 0 permanently in InterestTokenFixed

The report gives no description here.

MediumDEFAULT_ADMIN_ROLE is assigned to msg.sender during contracts deploymentFixed

The report gives no description here.

MediumIncorrect farm mode disable condition in FarmModeDecisionMakerFixed

The report gives no description here.

MediumincreaseAllowance and decreaseAllowance not disabled in DebtTokenFixed

The report gives no description here.

MediumNo _disableInitializers call in the constructor in VaultRegistryV1Fixed

The report gives no description here.

MediumNo parameters validationFixed

The report gives no description here.

MediumNon-zero balance with zero index in InterestTokenFixed

The report gives no description here.

Show 10 more

MediumPotential for duplicate token creation in TokensFactoryFixed

The report gives no description here.

MediumReassigned amountTotal value may bypass zero check in HarvestableManagerFixed

The report gives no description here.

LowCode duplication in HarvestableVaultV1, LiquidatableManagerFixed

The report gives no description here.

LowFee is charged on withdrawal in VaultCoreV1Fixed

The report gives no description here.

LowFloating pragmaFixed

The report gives no description here.

LowInt type initialization to zero is redundantFixed

The report gives no description here.

LowMagic numbersFixed

The report gives no description here.

LowMissed error handling in HarvestableManagerFixed

The report gives no description here.

LowSimplifying subtraction of commit.userHarvestUncommittedEarnings in HarvestableManagerFixed

The report gives no description here.

LowSuboptimal reading of the harvestStorage.harvests.length variable from storage in HarvestableManagerFixed

The report gives no description here.

Show 3 more

LowUnused constant MATH_UNITS in InterestTokenFixed

The report gives no description here.

LowUse ++i to save gasFixed

The report gives no description here.

LowUse += in CommitMathFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (102)

contracts/access/Ingress.sol
contracts/interfaces/internal/strategy/farming/IConvexFarmStrategy.sol
contracts/interfaces/internal/strategy/swap/ISwapStrategyConfiguration.sol
contracts/interfaces/internal/vault/extensions/groomable/IGroomableManager.sol
contracts/interfaces/internal/tokens/ISupplyToken.sol
contracts/vaults/v1/extensions/farmmode/FarmModeVault.sol
contracts/libraries/types/SupplyLossTypes.sol
contracts/interfaces/internal/vault/IVaultCoreV1Initializer.sol
contracts/oracles/UniswapV3Twap.sol
contracts/interfaces/internal/vault/IInterestVault.sol
contracts/common/ProxyExtension.sol
contracts/libraries/types/HarvestTypes.sol
contracts/vaults/v1/base/VaultStorage.sol
contracts/vaults/v1/ETH/VaultETH.sol
contracts/misc/BorrowVerifier.sol
contracts/interfaces/internal/access/IIngress.sol
contracts/vaults/v1/extensions/snapshotable/SnapshotableVault.sol
contracts/vaults/v1/ProxyInitializable.sol
contracts/decision-makers/farm-mode-decision/FarmModeDecisionMaker.sol
contracts/libraries/types/VaultTypes.sol
contracts/tokens/DebtToken.sol
contracts/libraries/utils/HealthFactorCalculator.sol
contracts/interfaces/internal/vault/IVaultStorage.sol
contracts/interfaces/internal/misc/incentives/rebalance/IRebalanceIncentivesController.sol
contracts/interfaces/internal/tokens/IDebtToken.sol
contracts/vaults/v1/VaultCore.sol
contracts/misc/incentives/rebalance/RebalanceIncentivesController.sol
contracts/vaults/v1/extensions/liquidatable/LiquidatableManager.sol
contracts/strategies/farming/convex/StrategyMeta3Pool.sol
contracts/tokens/TokensFactory.sol
contracts/interfaces/internal/oracles/IPriceSource.sol
contracts/interfaces/internal/decision-makers/farm-mode-decision/IFarmModeDecisionMaker.sol
contracts/vaults/v1/extensions/snapshotable/SnapshotableManager.sol
contracts/oracles/ChainlinkPrice.sol
contracts/vaults/v1/ERC20/VaultERC20.sol
contracts/interfaces/internal/strategy/lending/IAaveStrategy.sol
contracts/interfaces/internal/flashloan/IFlashLoanStrategy.sol
contracts/tokens/SupplyToken.sol
contracts/interfaces/internal/vault/extensions/IVaultExtensions.sol
contracts/strategies/farming/FarmBufferStrategy.sol
contracts/interfaces/internal/vault/extensions/groomable/IGroomableVault.sol
contracts/tokens/InterestToken.sol
contracts/interfaces/internal/misc/incentives/position/IPositionIncentivesController.sol
contracts/interfaces/internal/tokens/ITokensFactory.sol
contracts/vaults/v1/extensions/snapshotable/harvest/HarvestableVault.sol
contracts/strategies/swap/SwapStrategyConfiguration.sol
contracts/interfaces/internal/misc/vault-operable/IVaultOperable.sol
contracts/interfaces/internal/vault/extensions/supply-loss/ISupplyLossManager.sol
contracts/strategies/farming/convex/StrategyGenericPool.sol
contracts/vaults/v1/extensions/snapshotable/supply-loss/SupplyLossManager.sol
contracts/interfaces/internal/strategy/farming/IFarmStrategy.sol
contracts/common/VaultOperable.sol
contracts/interfaces/internal/vault/extensions/harvestable/IHarvestableVault.sol
contracts/vaults/v1/extensions/configurable/ConfigurableVault.sol
contracts/strategies/farming/convex/StrategyMetaPool.sol
contracts/interfaces/internal/strategy/farming/IFarmBuffer.sol
contracts/interfaces/internal/strategy/farming/IFarmDropMonitorStrategy.sol
contracts/interfaces/internal/vault/extensions/liquidatable/ILiquidatableVault.sol
contracts/interfaces/internal/vault/extensions/harvestable/IHarvestableManager.sol
contracts/interfaces/internal/strategy/lending/ILenderStrategy.sol
contracts/interfaces/internal/vault/IVaultRegistry.sol
contracts/interfaces/internal/strategy/IFlashLoanCallback.sol
contracts/interfaces/internal/oracles/IChainlinkPrice.sol
contracts/interfaces/internal/vault/IVaultCore.sol
contracts/vaults/v1/extensions/configurable/ConfigurableManager.sol
contracts/interfaces/internal/misc/IBorrowVerifier.sol
contracts/libraries/utils/FlashLoan.sol
contracts/strategies/swap/UniswapV3Strategy.sol
contracts/interfaces/internal/vault/extensions/snapshotable/ISnapshotableVault.sol
contracts/strategies/lending/LenderStrategy.sol
contracts/vaults/v1/extensions/groomable/GroomableManager.sol
contracts/vaults/v1/VaultRegistry.sol
contracts/vaults/v1/VaultInitializer.sol
contracts/strategies/lending/aave/v3/StrategyAaveV3.sol
contracts/vaults/v1/extensions/groomable/GroomableVault.sol
contracts/interfaces/internal/vault/extensions/configurable/IConfigurableVault.sol
contracts/interfaces/internal/vault/extensions/supply-loss/ISupplyLossVault.sol
contracts/strategies/swap/SwapStrategy.sol
contracts/strategies/flashloan/Aavev2FlashLoanStrategy.sol
contracts/strategies/swap/CurveV2Strategy.sol
contracts/strategies/farming/FarmStrategy.sol
contracts/interfaces/internal/vault/extensions/snapshotable/ISnapshotableManager.sol
contracts/vaults/v1/extensions/snapshotable/supply-loss/SupplyLossVault.sol
contracts/strategies/farming/FarmDropMonitorStrategy.sol
contracts/strategies/farming/FarmBuffer.sol
contracts/vaults/v1/extensions/farmmode/FarmModeManager.sol
contracts/vaults/v1/extensions/snapshotable/harvest/HarvestableManager.sol
contracts/interfaces/internal/strategy/farming/IFarmBufferStrategy.sol
contracts/interfaces/internal/tokens/IInterestToken.sol
contracts/misc/incentives/position/PositionIncentivesController.sol
contracts/strategies/farming/convex/StrategyStable2Pool.sol
contracts/interfaces/internal/vault/extensions/farmmode/IFarmModeManager.sol
contracts/libraries/utils/CommitMath.sol
contracts/vaults/v1/base/InterestVault.sol
contracts/libraries/utils/Utils.sol
contracts/libraries/types/CommonTypes.sol
contracts/common/Roles.sol
contracts/interfaces/internal/vault/extensions/liquidatable/ILiquidatableManager.sol
contracts/interfaces/internal/strategy/swap/ISwapStrategy.sol
contracts/interfaces/internal/vault/extensions/farmmode/IFarmModeVault.sol
contracts/vaults/v1/extensions/liquidatable/LiquidatableVault.sol
contracts/interfaces/internal/strategy/lending/ICompStrategy.sol

Part of Altitude’s security record

Altitude

Audits1 audit by 1 firmLast audit Jul 2024, by OXORIO.

Critical findingsNo open critical findingsIn that report, 1 critical finding was reported. It is marked fixed by the firm that reported it.

Open Altitude’s security record

Security firm

OXORIO

6 projects reviewed · 15 reports · latest Dec 2024

See OXORIO’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.