Part of CertiK’s series
CertiK reviewed Venus Protocol (Venus - WUSDMLiquidator) on 29 Apr 2025: 3 findings, 0 critical; all marked fixed.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 3 |
The `run()` function emits multiple events in the context of the Comptroller and different VTokens on every execution. Since `run()` is unprotected and can be invoked repeatedly, this behavior may lead to unexpected and potentially disruptive events. Furthermore, the function presumes that the `VWUSDM` market is paused for `Action.MINT` and `Action.ENTER_MARKET`, and maintains the paused state after execution. This may be unintended if the market gets unpaused in the future.
```sol=109 uint256 internal constant MAX_CLOSE_FACTOR_MANTISSA = 1e18; // 1.0, temporarily ``` `WUSDMLiquidator` assumes the Comptroller code will be upgraded, allowing `closeFactorMantissa` to be set higher than the regular 0.9e18. It is unclear when and if the `MAX_CLOSE_FACTOR_MANTISSA` will be restored. ```sol=124 COMPTROLLER.setCloseFactor(1e18); ``` `WUSDMLiquidator` uses the 1e18 value directly as a close factor. It's reasonable to use `COMPTROLLER.MAX_CLOSE_FACTOR_MANTISSA()` instead to ensure the call will always be successful. Or `MANTISSA_ONE` constant in case it is supposed to revert in case of unexpected COMPTROLLER behavior.
Despite the [description](https://community.venus.io/t/proposal-partial-liquidity-restoration-for-wusdm-on-venus-zksync/5013) stating that the WUSDMLiquidator is meant to be executed solely by Governance, the `run()` function is unprotected and can be called multiple times by any user.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (2)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us