Ramses V3 Security Smart Contract Audit

Summary

Executive Summary This report presents the results of our engagement with Ramses to review some of the Ramses V3 smart contracts. The review was conducted from July 2024 to August 2024 by Heiko Fisch and Arturo Roura, and extended into September 2024 by Vladislav Yaroshuk and Arturo Roura. The extension was due to the discovery of complex vulnerabilities and concerns regarding potential undiscovered issues. During this extended audit, the team focused on analyzing the root causes of these vulnerabilities and evaluating the various solutions proposed by the Ramses team.

Project

Ramses CL

Arbitrum

No active critical issues

Last audited on 2024/07/31

Auditor

59 audits on Trustblock

Multi-Tags

Issues (25)

	Low	Medium	High	Critical	Total
Not fixed	4	1	-	-	5
Fixed	15	2	2	1	20
Total	19	3	2	1	25

Contracts (7)

#	File Name
1	contracts/CL/core/libraries/PoolStorage.sol
2	contracts/CL/core/RamsesV3Factory.sol
3	contracts/CL/core/libraries/Tick.sol
4	contracts/CL/core/RamsesV3Pool.sol
5	contracts/CL/core/libraries/Position.sol
6	contracts/CL/core/RamsesV3PoolDeployer.sol
7	contracts/CL/core/libraries/Oracle.sol

Ramses V3

Summary

Issues (25)

If a Period Gets Skipped, SPL inside Will Return an Inflated Value for the Period, Which Will Result in Unexpected Behaviornot_fixed/medium

Burn of the Unexisting Positions Reverts With Panic Codenot_fixed/low

New Struct Fields endSecondsPerLiquidityPeriodX128 and periodStartTick Would Be a Better Fit for SwapCache Than SwapStatenot_fixed/low

parameters Struct Should Be Refactorednot_fixed/low

Pools Are Always Deployed With Uninitialized feeProtocolnot_fixed/low

Contracts (7)