Solv Protocol - SolvBTC
Summary
Quantstamp has completed an audit of the contracts to be upgraded in the Solv Protocol. These contracts enable the Solv Protocol to represent multiple `ERC3525` assets/slots using a single ERC20 token. The audited contracts include: - `SolvBTC`: These new ERC20 tokens represent several selected assets and will replace `SftWrappedToken`(not in scope). - `SolvBTCYieldTokenOracleForSFT.sol `: This contract provides NAV (Net Asset Value) calculation and oracle management for `SolvBTCYieldToken.sol`, an extension of `SolvBTC`, associated with SFTs. - `SolvBTCMultiAssetPool`: This contract stores the selected assets and issues `SolvBTC` tokens. - `SftWrapRouter`: This user-facing contract facilitates the staking and unstaking of ERC3525 assets and routing operations to the appropriate contract. - `SftWrappedTokenFactory`: This contract manages the deployment and upgrading of beacons and proxies for wrapped tokens, ensuring efficient and flexible contract upgrades. Overall, the code is well-written, and the Solv team has shown excellent engineering skills. However, the audit process was somewhat hindered by the lack of technical documentation, making it challenging to fully understand the upgrade context and intentions. **Fix Review Update**: The Solv team has reworked their contracts, fixed 3 issues, and acknowledged 3 issues. Most of our suggestions were implemented. It should be noted that some of the reworked code was not in scope for the fix review since it did not directly address an issue or suggestions. However, we were able to identify an out-of-scope issue that we recommend addressing. **Fix Review Update 2**: The new issue SOLV-7 and additions in SOLV-10 were acknowledged by the client. **Fix Review Update 3**: The client added a new `burn()` function for compatibility with Chainlink CCIP. Another role, `SOLVBTC_POOL_BURNER`, was added that can burn unrestricted amounts of `SolvBTC` tokens from any address.
