ekubo protocol

Cairo Security Clan29 Apr 2024Files named in the report

Cairo Security Clan reviewed Ekubo Protocol on 29 Apr 2024: 4 findings, 0 critical; 2 marked fixed, 2 open.

No open critical findings

Open the report Open Ekubo Protocol’s security record

Report stored on IPFS. Content hash bafybeietwfoct4234hhtdxqb2qpm742ntyq5e3q262tmwe24ych45v4gpu

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	1
Medium	0	0
Low	2	1

Highcancelled proposal can still be executedFixed

In the governor contract, each proposal's status is tracked by three timestamp values: created, executed, and cancelled. These variables are checked in core functions to ensure correct state changes. However, the execute function does not verify if a proposal has been cancelled by checking cancelled.is_zero. As a result, a cancelled proposal could still be executed if it received enough votes before being cancelled.

Lowthe delegatedsnapshot field delegated_cumulative can overflow into timestampFixed

The packing implementation for the delegatedsnapshot struct compresses a u64 timestamp and a u256 cumulative delegated amount into a felt252 field. It is possible for the cumulative delegated amount to overflow into the bits reserved for the timestamp, causing incorrect timestamp increments and affecting functions that use timestamps to search snapshots.