ekubo protocol

Cairo Security Clan29 Apr 2024Files named in the report

Cairo Security Clan reviewed Ekubo Protocol on 29 Apr 2024: 4 findings, 0 critical; 2 marked fixed, 2 open.

No open critical findings

Open the report Open Ekubo Protocol’s security record

Report stored on IPFS. Content hash bafybeietwfoct4234hhtdxqb2qpm742ntyq5e3q262tmwe24ych45v4gpu

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	1
Medium	0	0
Low	2	1

Lowgovernor needs to create another proposal to cancel a queued callOpen

After a proposal is proposed, voted on, and executed, it is queued in the timelock to be executed after the delay period. Only the owner, set to the governor contract, can call queue and cancel functions in the timelock. Therefore, canceling a queued call requires going through the proposal-voting-execution process, which could take longer than the timelock delay, making it impossible to cancel a queued call via the current process.

Lowunnecessary assertionOpen

The function execute contains an assertion that the current block timestamp is non-zero, which is always true except in testing. It is recommended to remove the unnecessary assertion for production use.