Fei Protocol v2 Phase 1

Off-Chain (Private)

Audited on 2021/08/31

No active critical issues

Summary

Executive Summary This report presents the results of our engagement with Fei Protocol to review Fei v2 Phase 1. Stage 1 The review was conducted over two weeks, from September 13–24, 2021. A total of 30 person-days were spent. During the first week, the team ramped up on understanding the system and the significant changes that are introduced. These efforts continued into the second week where the team followed up on potential threats to specific components.

Project

Fei Protocol

Ethereum

Issues (21)

	Low	Medium	High	Critical	Total
Not fixed	13	6	2	-	21
Fixed	-	-	-	-	0
Total	13	6	2	0	21

Contracts (27)

#	File Name
21	contracts/oracle/ICollateralizationOracle.sol
22	contracts/Constants.sol
23	contracts/pcv/utils/ERC20Splitter.sol
24	contracts/utils/RateLimitedMinter.sol
25	contracts/token/IFeiTimedMinter.sol
26	contracts/oracle/ICollateralizationOracleWrapper.sol
27	contracts/pcv/balancer/manager/WeightedBalancerPoolManager.sol

#	File Name
21	contracts/oracle/ICollateralizationOracle.sol
22	contracts/Constants.sol
23	contracts/pcv/utils/ERC20Splitter.sol
24	contracts/utils/RateLimitedMinter.sol
25	contracts/token/IFeiTimedMinter.sol
26	contracts/oracle/ICollateralizationOracleWrapper.sol
27	contracts/pcv/balancer/manager/WeightedBalancerPoolManager.sol

Fei Protocol v2 Phase 1

Summary

Issues (21)

CollateralizationOracle - Fei in excluded deposits contributes to userCirculatingFeinot_fixed/high

StableSwapOperatorV1 - resistantFei value is not correct in the resistantBalanceAndFei functionnot_fixed/high

BalancerLBPSwapper - init() can be front-run to potentially steal tokensnot_fixed/medium

ChainlinkOracleWrapper - latestRoundData might return stale resultsnot_fixed/medium

CollateralizationOracleWrapper - the deviation threshold check in update() always returns falsenot_fixed/medium

Contracts (27)