Idle Finance

QuantstampFiles named in the report

Audit

Quantstamp reviewed Idle Finance on 23 Apr 2021: 39 findings, 0 critical; 22 marked fixed, 14 acknowledged, 3 open.

No open critical findings
Open the reportOpen Idle Finance’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings39

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium103
Low21419
MediumWrong comparison between lengthsOpen

On L148 in `IdleTokenGovernance.sol` we can see the following `require` statement: `require(_newGovTokensEqualLen.length >= protocolTokens.length, '!EQ');` From the other occurrences of `!EQ` we believe that it should indicate that the 2 terms being compared are not equal, which is different from what the Boolean expression in that `require` statement is comparing, that is the comparison is actually checking if the length of the `_newGovTokensEqualLen` is higher-or-equal to the length of `protocolTokens`.

LowInconsistent array lengths breaks invariantOpen

**Note:** this issue is essentially the same as QSP-24 from a previous audit; the fix appears to have been reverted. The length of the `allAvailableTokens` array and the `lastRebalancerAllocations` and `lastAllocations` arrays may diverge after calling `setAllAvailableTokensAndWrappers()`. This is because the allocations are not adjusted or checked to be of the same length with the `protocolTokens` or `wrappers` input arrays of the `setAllAvailableTokensAndWrappers()` function. This means that the owner can effectively remove tokens from the `allAvailableTokens` array and the sum of all corresponding allocations would not be 100% by calling `setAllAvailableTokensAndWrappers()`.

LowOwner can front-run flash loaners to change loan feeOpen

The owner of the `IdleTokenGovernance` contract has the privilege of front running any end-user who calls `flashLoan()` by calling `setFlashLoanFee()` and increasing the flash loan fee. Coupled with the fact that the `flashLoanFee` can be set up to 100% inside the `setFlashLoanFee()` function, this could be detrimental to the caller if sufficient funds are available in the caller's balance.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (123)

  • contracts/interfaces/AaveLendingPoolV2.sol
  • contracts/wrappers/IdleFulcrumDisabled.sol
  • contracts/mocks/IdleTokenHelperNoConst.sol
  • contracts/IdleViewHelper.sol
  • contracts/interfaces/IERC20Detailed.sol
  • contracts/mocks/IdleDyDxNoConst.sol
  • contracts/interfaces/GasToken.sol
  • contracts/interfaces/IProxyAdmin.sol
  • contracts/mocks/USDCMock.sol
  • contracts/mocks/DAIMock.sol
  • contracts/interfaces/IStableDebtToken.sol
  • contracts/mocks/WETHMock.sol
  • contracts/interfaces/IIdleTokenV3_1.sol
  • contracts/interfaces/IIdleRebalancerV3.sol
  • contracts/mocks/aDAIWrapperMock.sol
  • contracts/mocks/cUSDCMock.sol
  • contracts/mocks/PotLikeMock.sol
  • contracts/interfaces/IIdleRebalancer.sol
  • contracts/interfaces/AaveInterestRateStrategy.sol
  • contracts/wrappers/IdleFulcrum.sol
  • contracts/mocks/DyDxMock.sol
  • contracts/interfaces/IIdleTokenGovernance.sol
  • contracts/interfaces/IInterestSetter.sol
  • contracts/mocks/aaveLendingPoolMock.sol
  • contracts/interfaces/AaveLendingPoolProvider.sol
  • contracts/mocks/AaveVariableDebtTokenMock.sol
  • contracts/mocks/IdleControllerMock.sol
  • contracts/interfaces/AaveLendingPoolCore.sol
  • contracts/interfaces/IGovernorAlpha.sol
  • contracts/interfaces/IIdleTokenHelper.sol
  • contracts/interfaces/RealUSDC.sol
  • contracts/mocks/CHAIMock.sol
  • contracts/interfaces/IGovToken.sol
  • contracts/mocks/AaveStableDebtTokenMock.sol
  • contracts/mocks/iDAIMock.sol
  • contracts/mocks/PriceOracleMock.sol
  • contracts/interfaces/PriceOracle.sol
  • contracts/mocks/cDAIWrapperMock.sol
  • contracts/mocks/yxDAIWrapperMock.sol
  • contracts/wrappers/IdleDyDx.sol
  • contracts/interfaces/AToken.sol
  • contracts/mocks/COMPMock.sol
  • contracts/interfaces/IAdminUpgradeabilityProxy.sol
  • contracts/IdleBatchConverter.sol
  • contracts/mocks/IdleAaveNoConst.sol
  • contracts/interfaces/IIdleTokenV3.sol
  • contracts/interfaces/Comptroller.sol
  • contracts/mocks/cUSDCWrapperMock.sol
  • contracts/GST2Consumer.sol
  • contracts/mocks/IdleTokenHelperMock.sol
  • contracts/wrappers/yxToken.sol
  • contracts/interfaces/PotLike.sol
  • contracts/interfaces/USDT.sol
  • contracts/mocks/cWETHMock.sol
  • contracts/wrappers/IdleAaveV2.sol
  • contracts/interfaces/UniswapV2Router.sol
  • contracts/interfaces/IdleController.sol
  • contracts/Migrations.sol
  • contracts/mocks/WhitePaperMock.sol
  • contracts/interfaces/CHAI.sol
  • contracts/mocks/FlashLoanerMock.sol
  • contracts/interfaces/DataTypes.sol
  • contracts/mocks/idleBatchMock.sol
  • contracts/mocks/aaveLendingPoolCoreMock.sol
  • contracts/IdleRebalancerV3_1.sol
  • contracts/interfaces/IERC3156FlashLender.sol
  • contracts/IdleTokenV3_1.sol
  • contracts/libraries/DSMath.sol
  • contracts/interfaces/IIdleToken.sol
  • contracts/interfaces/GovernorAlpha.sol
  • contracts/mocks/yxTokenNoConst.sol
  • contracts/mocks/IDLEMock.sol
  • contracts/interfaces/IVariableDebtToken.sol
  • contracts/mocks/GasTokenMock.sol
  • contracts/interfaces/CERC20.sol
  • contracts/interfaces/Gauge.sol
  • contracts/interfaces/CETH.sol
  • contracts/GST2ConsumerV2.sol
  • contracts/others/BasicMetaTransaction.sol
  • contracts/mocks/idleNewBatchMock.sol
  • contracts/wrappers/IdleAave.sol
  • contracts/interfaces/DyDxStructs.sol
  • contracts/mocks/aaveInterestRateStrategyMock.sol
  • contracts/mocks/IdleDSRNoConst.sol
  • contracts/MinimalInitializableProxyFactory.sol
  • contracts/interfaces/DyDx.sol
  • contracts/interfaces/Idle.sol
  • contracts/interfaces/ILendingProtocol.sol
  • contracts/interfaces/IWETH.sol
  • contracts/mocks/IdleTokenV3_1Mock.sol
  • contracts/mocks/aaveLendingPoolMockV2.sol
  • contracts/others/EIP712MetaTransaction.sol
  • contracts/wrappers/IdleCompoundV2.sol
  • contracts/wrappers/IdleCompound.sol
  • contracts/wrappers/IdleFulcrumV2.sol
  • contracts/mocks/cDAIMock.sol
  • contracts/interfaces/IERC3156FlashBorrower.sol
  • contracts/mocks/ForceSend.sol
  • contracts/wrappers/IdleCompoundETH.sol
  • contracts/interfaces/IERC20Mintable.sol
  • contracts/IdleTokenGovernance.sol
  • contracts/interfaces/AaveLendingPool.sol
  • contracts/interfaces/WhitePaperInterestRateModel.sol
  • contracts/mocks/iDAIWrapperMock.sol
  • contracts/mocks/aaveLendingPoolProviderMock.sol
  • contracts/mocks/yxTokenMock.sol
  • contracts/interfaces/AaveLendingPoolProviderV2.sol
  • contracts/mocks/aDAIMock.sol
  • contracts/others/EIP712Base.sol
  • contracts/mocks/AaveInterestRateStrategyMockV2.sol
  • contracts/interfaces/iERC20Fulcrum.sol
  • contracts/interfaces/IUniswapV2Router02.sol
  • contracts/interfaces/Vester.sol
  • contracts/wrappers/IdleDSR.sol
  • contracts/IdleTokenHelper.sol
  • contracts/mocks/ComptrollerMock.sol
  • contracts/interfaces/AaveInterestRateStrategyV2.sol
  • contracts/interfaces/VesterFactory.sol
  • contracts/interfaces/IAToken.sol
  • contracts/mocks/InterestSetterMock.sol
  • contracts/interfaces/UniswapExchangeInterface.sol
  • contracts/tests/Foo.sol
  • contracts/mocks/IdleTokenV3_1NoConst.sol

Part of Idle Finance’s security record

Idle Finance
Audits3 audits by 2 firmsLast audit Jun 2021, by Consensys.
Critical findingsNo open critical findingsAcross 3 reports.
Open Idle Finance’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us