Fodl
Quantstamp reviewed Fodl Finance (Fodl) on 13 Oct 2021: 11 findings, 0 critical; 4 marked fixed, 5 acknowledged, 2 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings11
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 2 | 5 | 4 |
Low`createAccount()` may fail if existing NFT is transferredFixed
When creating a new account, the `create2` salt is defined as `uint256 salt = uint256(keccak256(abi.encodePacked(msg.sender, fodlNFT.balanceOf(msg.sender))));`. Since the NFT is an ERC721, it may be transferred to a different address. Suppose the user has created one account, but then transfers it to a different address (such that `fodlNFT.balanceOf(user)` is reduced back to 0). On a second invocation of `createAccount()`, the salt `uint256(keccak256(abi.encodePacked(user, 0)))` will be exactly the same as the first invocation, and the `create2` call will fail.
LowClone-and-OwnFixed
The clone-and-own approach involves copying and adjusting open source code at one's own discretion. From the development perspective, it is initially beneficial as it reduces the amount of effort. However, from the security perspective, it involves some risks as the code may not follow the best practices, may contain a security vulnerability, or may include intentionally or unintentionally modified upstream libraries. Rather than the clone-and-own approach, a good industry practice is to use a framework for managing library dependencies. This eliminates the clone-and-own risks yet allows for following best practices, such as, using libraries.
LowConstraints do not match inline commentsFixed
1. In `StopLossStorage.sol` on L25, the `unwindFactor` is claimed to range from “1 to 100”. However, `SimplePositionStopLossConnector.configureStopLoss()` checks that `unwindFactor <= MANTISSA`. A similar issue exists for `slippageIncentive`. 1. In `SimplePositionStopLossConnector.sol` on L52,54: ``` // check that collateralUsageLimit <= collateralUsage require(getCollateralUsageFactor() > stopLossConfiguration.collateralUsageLimit, 'SLC5'); ``` Either the first line should use `<=`, or the second line should use `>=` to match the comment. Note that L161 uses the same constraint.
LowUnclear use of `create2` opcodeFixed
`create2` is used in the context where there is a need to predict the contract address before deploying it. There is no mention in the documentation for such a feature, yet, the opcode is still used in `createAccount()` function.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (71)
- contracts/Fodl/modules/FlashLoaner/DyDx/ICallee.sol
- contracts/Fodl/connectors/SimplePosition/SimplePositionStopLossConnector.sol
- contracts/Fodl/mocks/AavePriceOracleMock.sol
- contracts/Libs/IUSDT.sol
- contracts/Fodl/modules/Exchanger/UniswapExchangerAdapter.sol
- contracts/Fodl/modules/StopLoss/StopLossStorage.sol
- contracts/Fodl/connectors/SimplePosition/DecreaseWithV3FlashswapMultihopConnector.sol
- contracts/Fodl/modules/Exchanger/SushiswapExchangerAdapter.sol
- contracts/Libs/IWBTC.sol
- contracts/Fodl/connectors/ResetAccountConnector.sol
- contracts/Fodl/connectors/AllConnectors.sol
- contracts/Fodl/connectors/SimplePosition/LeverageWithV3FlashswapConnector.sol
- contracts/Fodl/core/interfaces/IFoldingConnectorProvider.sol
- contracts/Fodl/modules/Lender/ILendingPlatform.sol
- contracts/Fodl/modules/Lender/Compound/ICEther.sol
- contracts/Fodl/modules/Exchanger/ControlledExchangerAdapter.sol
- contracts/Fodl/connectors/interfaces/ISimplePositionLendingConnector.sol
- contracts/Fodl/core/FodlNFT.sol
- contracts/Fodl/connectors/interfaces/IIncreaseWithV3FlashswapMultihopConnector.sol
- contracts/Fodl/modules/Exchanger/ExchangerDispatcher.sol
- contracts/FodlToken/FodlToken.sol
- contracts/Fodl/modules/FlashLoaner/DyDx/DydxFlashloanBase.sol
- contracts/Fodl/core/FoldingRegistry.sol
- contracts/Fodl/core/interfaces/IFoldingAccountOwnerProvider.sol
- contracts/Fodl/connectors/interfaces/IClaimRewardsConnector.sol
- contracts/Fodl/modules/FoldingAccount/FoldingAccountStorage.sol
- contracts/Fodl/modules/Flashswapper/FlashswapStorage.sol
- contracts/Fodl/modules/SimplePosition/SimplePositionStorage.sol
- contracts/Fodl/lens/LendingPlatformLens.sol
- contracts/Libs/IWETH.sol
- contracts/Fodl/connectors/SimplePosition/IncreaseWithV3FlashswapMultihopConnector.sol
- contracts/Fodl/lens/SimplePositionLens.sol
- contracts/Libs/Uint2Str.sol
- contracts/Libs/IDAI.sol
- contracts/Fodl/modules/FundsManager/FundsManager.sol
- contracts/Fodl/connectors/interfaces/IResetAccountConnector.sol
- contracts/Fodl/modules/Lender/Aave/Interfaces.sol
- contracts/Fodl/connectors/interfaces/ISimplePositionLeveragedLendingConnector.sol
- contracts/Fodl/modules/Lender/LendingDispatcher.sol
- contracts/Fodl/modules/Lender/Compound/ICompoundPriceOracle.sol
- contracts/Fodl/modules/Lender/Compound/ICToken.sol
- contracts/Fodl/modules/Lender/Aave/AaveLendingAdapter.sol
- contracts/Fodl/connectors/SimplePosition/SimplePositionLeveragedLendingConnector.sol
- contracts/Fodl/core/interfaces/IExchangerAdapterProvider.sol
- contracts/Fodl/core/interfaces/ICTokenProvider.sol
- contracts/Fodl/mocks/FoldingRegistryUpgradedMock.sol
- contracts/Fodl/mocks/CompoundPriceOracleMock.sol
- contracts/Fodl/connectors/SimplePosition/SimplePositionBaseConnector.sol
- contracts/Fodl/modules/Lender/Compound/IComptroller.sol
- contracts/Libs/IUSDC.sol
- contracts/Libs/IDOLA.sol
- contracts/Fodl/core/interfaces/ILendingPlatformAdapterProvider.sol
- contracts/Fodl/modules/FlashLoaner/DyDx/DyDxFlashModule.sol
- contracts/Libs/Mathemagic.sol
- contracts/Fodl/modules/FlashLoaner/DyDx/ISoloMargin.sol
- contracts/Fodl/mocks/ExchangerMock.sol
- contracts/Fodl/connectors/interfaces/ILeverageWithV3FlashswapConnector.sol
- contracts/Fodl/connectors/SimplePosition/ClaimRewardsConnector.sol
- contracts/Fodl/modules/Lender/Compound/CompoundForksLendingAdapter.sol
- contracts/Fodl/connectors/interfaces/ISimplePositionBaseConnector.sol
- contracts/Fodl/modules/Exchanger/TestExposedExchangerDispatcher.sol
- contracts/Fodl/connectors/interfaces/ISimplePositionStopLossConnector.sol
- contracts/Libs/ForceSend.sol
- contracts/Fodl/core/FoldingAccount.sol
- contracts/Fodl/connectors/SimplePosition/SimplePositionLendingConnector.sol
- contracts/Fodl/modules/Exchanger/IExchanger.sol
- contracts/Fodl/mocks/ERC20Mock.sol
- contracts/Fodl/modules/Exchanger/IUniswap.sol
- contracts/Fodl/connectors/interfaces/IDecreaseWithV3FlashswapMultihopConnector.sol
- contracts/Fodl/modules/Exchanger/ControlledExchanger.sol
- contracts/FodlRewards/RewardsDistributor.sol
Part of Fodl Finance’s security record
Security firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us