Fodl

QuantstampFiles named in the report

Audit

Quantstamp reviewed Fodl Finance (Fodl) on 13 Oct 2021: 11 findings, 0 critical; 4 marked fixed, 5 acknowledged, 2 open.

No open critical findings
Open the reportOpen Fodl Finance’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low254
LowApprovals are not reset to 0Acknowledged

Approvals are not reset to 0 after swaps in `exchange()`, `swapFromExact()` and `swapToExact()`.

LowInaccurate `BLOCKS_PER_YEAR`Acknowledged

The constant `BLOCKS_PER_YEAR = 365 * 24 * 60 * 4` suggests 15 second block times, which does not reflect the typical block times for the past year of around 13 seconds. This will inflate the calculated supply and borrow APRs. Furthermore, the actual number of blocks may depend on the network on which the contracts are deployed.

LowInteraction with External ContractsAcknowledged

The protocol relies on functionalities of external contracts. Therefore, security of the project depends on these contracts. While we are unaware of any immediate issues, it is important to note that DeFi protocols may be vulnerable to market manipulation, computational errors, etc. Furthermore, we also want to note that the project assumes constant supply of the external tokens, i.e., inflationary and deflationary tokens are not compatible (e.g., with `Fodl/modules/FundsManager/FundsManager.sol`).

LowPrivileged Roles and OwnershipAcknowledged

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. Specifically: 1. The contracts use the diamond pattern, which allows the owner to change implementations arbitrarily. 1. The `FundsManager` implements a tax on withdrawals. There is no limit in the contract for how large the tax percentage can be.

LowUniswap exchanger does not allow multi-step pathsAcknowledged

The function `exchange()` constructs a routing path between the `fromToken` and the `toToken`, however not all token pairs have a direct routing path in Uniswap. In such cases, it is often sufficient to create a routing path that first converts `fromToken` to ETH, and then from ETH to the `toToken`. The same issue exists for all functions that construct a routing path in the contract.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (71)

  • contracts/Fodl/modules/FlashLoaner/DyDx/ICallee.sol
  • contracts/Fodl/connectors/SimplePosition/SimplePositionStopLossConnector.sol
  • contracts/Fodl/mocks/AavePriceOracleMock.sol
  • contracts/Libs/IUSDT.sol
  • contracts/Fodl/modules/Exchanger/UniswapExchangerAdapter.sol
  • contracts/Fodl/modules/StopLoss/StopLossStorage.sol
  • contracts/Fodl/connectors/SimplePosition/DecreaseWithV3FlashswapMultihopConnector.sol
  • contracts/Fodl/modules/Exchanger/SushiswapExchangerAdapter.sol
  • contracts/Libs/IWBTC.sol
  • contracts/Fodl/connectors/ResetAccountConnector.sol
  • contracts/Fodl/connectors/AllConnectors.sol
  • contracts/Fodl/connectors/SimplePosition/LeverageWithV3FlashswapConnector.sol
  • contracts/Fodl/core/interfaces/IFoldingConnectorProvider.sol
  • contracts/Fodl/modules/Lender/ILendingPlatform.sol
  • contracts/Fodl/modules/Lender/Compound/ICEther.sol
  • contracts/Fodl/modules/Exchanger/ControlledExchangerAdapter.sol
  • contracts/Fodl/connectors/interfaces/ISimplePositionLendingConnector.sol
  • contracts/Fodl/core/FodlNFT.sol
  • contracts/Fodl/connectors/interfaces/IIncreaseWithV3FlashswapMultihopConnector.sol
  • contracts/Fodl/modules/Exchanger/ExchangerDispatcher.sol
  • contracts/FodlToken/FodlToken.sol
  • contracts/Fodl/modules/FlashLoaner/DyDx/DydxFlashloanBase.sol
  • contracts/Fodl/core/FoldingRegistry.sol
  • contracts/Fodl/core/interfaces/IFoldingAccountOwnerProvider.sol
  • contracts/Fodl/connectors/interfaces/IClaimRewardsConnector.sol
  • contracts/Fodl/modules/FoldingAccount/FoldingAccountStorage.sol
  • contracts/Fodl/modules/Flashswapper/FlashswapStorage.sol
  • contracts/Fodl/modules/SimplePosition/SimplePositionStorage.sol
  • contracts/Fodl/lens/LendingPlatformLens.sol
  • contracts/Libs/IWETH.sol
  • contracts/Fodl/connectors/SimplePosition/IncreaseWithV3FlashswapMultihopConnector.sol
  • contracts/Fodl/lens/SimplePositionLens.sol
  • contracts/Libs/Uint2Str.sol
  • contracts/Libs/IDAI.sol
  • contracts/Fodl/modules/FundsManager/FundsManager.sol
  • contracts/Fodl/connectors/interfaces/IResetAccountConnector.sol
  • contracts/Fodl/modules/Lender/Aave/Interfaces.sol
  • contracts/Fodl/connectors/interfaces/ISimplePositionLeveragedLendingConnector.sol
  • contracts/Fodl/modules/Lender/LendingDispatcher.sol
  • contracts/Fodl/modules/Lender/Compound/ICompoundPriceOracle.sol
  • contracts/Fodl/modules/Lender/Compound/ICToken.sol
  • contracts/Fodl/modules/Lender/Aave/AaveLendingAdapter.sol
  • contracts/Fodl/connectors/SimplePosition/SimplePositionLeveragedLendingConnector.sol
  • contracts/Fodl/core/interfaces/IExchangerAdapterProvider.sol
  • contracts/Fodl/core/interfaces/ICTokenProvider.sol
  • contracts/Fodl/mocks/FoldingRegistryUpgradedMock.sol
  • contracts/Fodl/mocks/CompoundPriceOracleMock.sol
  • contracts/Fodl/connectors/SimplePosition/SimplePositionBaseConnector.sol
  • contracts/Fodl/modules/Lender/Compound/IComptroller.sol
  • contracts/Libs/IUSDC.sol
  • contracts/Libs/IDOLA.sol
  • contracts/Fodl/core/interfaces/ILendingPlatformAdapterProvider.sol
  • contracts/Fodl/modules/FlashLoaner/DyDx/DyDxFlashModule.sol
  • contracts/Libs/Mathemagic.sol
  • contracts/Fodl/modules/FlashLoaner/DyDx/ISoloMargin.sol
  • contracts/Fodl/mocks/ExchangerMock.sol
  • contracts/Fodl/connectors/interfaces/ILeverageWithV3FlashswapConnector.sol
  • contracts/Fodl/connectors/SimplePosition/ClaimRewardsConnector.sol
  • contracts/Fodl/modules/Lender/Compound/CompoundForksLendingAdapter.sol
  • contracts/Fodl/connectors/interfaces/ISimplePositionBaseConnector.sol
  • contracts/Fodl/modules/Exchanger/TestExposedExchangerDispatcher.sol
  • contracts/Fodl/connectors/interfaces/ISimplePositionStopLossConnector.sol
  • contracts/Libs/ForceSend.sol
  • contracts/Fodl/core/FoldingAccount.sol
  • contracts/Fodl/connectors/SimplePosition/SimplePositionLendingConnector.sol
  • contracts/Fodl/modules/Exchanger/IExchanger.sol
  • contracts/Fodl/mocks/ERC20Mock.sol
  • contracts/Fodl/modules/Exchanger/IUniswap.sol
  • contracts/Fodl/connectors/interfaces/IDecreaseWithV3FlashswapMultihopConnector.sol
  • contracts/Fodl/modules/Exchanger/ControlledExchanger.sol
  • contracts/FodlRewards/RewardsDistributor.sol

Part of Fodl Finance’s security record

Fodl Finance
Audits1 audit by 1 firmLast audit Oct 2021, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Fodl Finance’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us