NetWeave Finance

QuillAudits28 May 2024Code version: not recorded (see the report)

Audit · firm’s term: audit report

QuillAudits reviewed NetWeave (NetWeave Finance) on 28 May 2024: 7 findings, 0 critical; 2 marked fixed, 5 acknowledged.

No open critical findings

Open the report Open NetWeave’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	2	0
Low	3	2

MediumAccess control issuesAcknowledged

It was observed that most of the privileged functionality is controlled by the admin. Additional authorization levels are needed to implement the principle of least privilege, also known as least authority, which ensures only authorized processes, users, or programs can access necessary resources or information. Although the contract defines roles responsible for various actions, they can be bypassed by admin. Code Location: The owner can access those functions in Comptroller contract: • _setRewardDistributor • _setPriceOracle • _setCloseFactor • _setCollateralFactor • _setMaxAssets • _setLiquidationIncentive • _supportMarket The owner can bypass role-based access control of those functions in Comptroller: • _setMarketBorrowCaps • _setMintPaused • _setBorrowPaused • _setTransferPaused • _setSeizePaused

MediumNo check for staleness of the returned data from chainLinkPrice oracleAcknowledged

In contract comptroller, in borrowAllowed() function it is checking for the price if it is 0 but it is not checking for the staleness of the returned price from the latestRoundData() in _getChainLinkPrice function in ChainLinkOraclePrice.sol

LowMissing check for min/max value on closeFactorAcknowledged

In contract comptroller, in _setCloseFactor() function there should be a check range between values but it is not present which can cause issue that value might go out of mentioned range. The mentioned range in contract is between min: 0.05e18 and max: 0.09e18

LowMissing reward updation before changing distributorAcknowledged

In contract comptroller, while the function updates new RewardDistributor address in _setRewardDistributor but if old RewardDistributor contract is not empty then proper rewards might not even be distributed

LowUse call instead of transfer for ethAcknowledged

In contract RewardDistributor, grantRewardInternal uses transfer for eth transfer on payable user.The use of the deprecated transfer() function for an address will inevitably make the transaction fail when: • The claimer smart contract does not implement a payable function. • The claimer smart contract does implement a payable fallback which uses more than 2300 gas unit. • The claimer smart contract implements a payable fallback function that needs less than 2300 gas units but is called through proxy, raising the call's gas usage above 2300. Additionally, using higher than 2300 gas might be mandatory for some multisig wallets.