RariCapital
Quantstamp reviewed Rari Capital (RariCapital) on 20 Aug 2020: 33 findings, 0 critical; 14 marked fixed, 14 acknowledged, 5 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings33
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 1 | 1 | 4 |
| Low | 4 | 13 | 7 |
MediumGas Usage / `for` Loop ConcernsOpen
Gas usage is a main concern for smart contract developers and users, since high gas costs may prevent users from wanting to use the smart contract. Even worse, some gas usage issues may prevent the contract from providing services entirely. For example, if a `for` loop requires too much gas to exit, then it may prevent the contract from functioning correctly entirely. The following instances have been found in the code base: 1. The nested `for`-loops inside `upgradeFundManager` could reach an out-of-gas error if the total number of pools for all currencies becomes large enough. This would prevent upgrades of `RariFundManager.sol`. 1. The nested `for`-loops inside `upgradeFundContoller` could reach an out-of-gas error if the total number of pools for all currencies becomes large enough. This would prevent upgrades of `RariFundController.sol`. 1. The loop inside `setFundManager` could reach an out-of-gas error if the number of supported currencies was too high. 1. The `withdrawAndExchange` function could reach an out-of-gas error if the number of `inputCurrenyCodes` was too high. 1. `getAllBalances` in `RariFundController` contains nested loops and a call to potentially expensive external functions inside the inner loop. 1. `marketSell0xOrdersFillOrKill` contains a loop with calls to to potentially expensive external functions and could reach an out-of-gas error if the number of orders was too high. 1. `checkLossRateLimit` contains a loop and could reach an out-of-gas error if the `_lossRateHistory` was too long. 1. `cachePoolBalances` contains nested loops and could reach an out-of-gas error if the number of supported currencies and number of pools was too high. 1. The loop inside `_withdrawFrom` could reach an out-of-gas error if the number of pools for a given currency code was too high. 1. The `exchangeAndDeposit` and the `withdrawAndExchange` functions in `RariFundProxy.sol` use `transfer()` instead of `call.value()` on L203 and L259, respectively. This might have issues when gas cost changes in the future. This has happened in the Istanbul hard fork, which increased the cost such that several existing smart contracts which were using `transfer()` broke due to out-of-gas errors. We anticipate that gas cost will continue to change in the future. 1. The `marketSell0xOrdersFillOrKill` function in `RariFundController.sol` uses `transfer()` instead of `call.value()` on L524. This might have issues when gas cost changes in the future. 1. The upgrade approach in `initNetDeposits()` might not be feasible if there are a significant number of users. Consider proxy storage approaches instead.
LowAllowance Double-Spend ExploitOpen
As it presently is constructed, the contract is vulnerable to the [allowance double-spend exploit](https://github.com/OpenZeppelin/openzeppelin-solidity/blob/b4f87bb8fc25fb07f73099701e39e167a3d36465/contracts/token/ERC20/ERC20.sol#L71-L78), as with other ERC20 tokens.
LowExperimental features should not be used on Mainnet deploymentsOpen
Until solidity `0.6.0`, the `ABIEncoderV2` feature is still technically in experimental state. Although there are no known security risks associated with it, these features should be used judiciously.
LowMissing input argument validationOpen
The following functions are missing validation of input arguments: 1. `upgradeFundController` does not validate the input parameter `newContract`, which could lead to sending all funds to any EOA. **Fixed** 1. `setFundManager` does not validate the input parameter `newContract`, which could lead to setting the fund manager to any EOA. 1. `setFundController` does not validate the input parameter `newContract`, which could lead to setting the fund controller to any EOA. 1. `authorizeFundManagerDataSource` does not validate the input parameter `authorizedFundManagerDataSource`, which could lead to setting a data source value of `0x0` for the fund manager. 1. `setFundToken` does not validate the input parameter `newContract`, which could lead to setting the token to any EOA. 1. `setFundProxy` does not validate the input parameter `newContract`, which could lead to setting the proxy to any EOA. 1. `setGsnTrustedSigner` does not validate the input parameter `newAddress`, which could lead to setting the fund manager to `0x0`. 1. `setInterestFeeRate()` should ensure that the rate is `<= 10**18`. **Fixed**
LowOff-by-one errorOpen
There is a recurring condition that appears in 6 methods inside the `RariFundToken` contract, namely: `if (address(rariGovernanceTokenDistributor) != address(0) && block.number > rariGovernanceTokenDistributor.distributionStartBlock())`, which appears in the following functions: `transfer`, `transferFrom`, `mint`, `burn`, `burnFrom`and ` fundManagerBurnFrom`. The second clause in the aforementioned condition is off-by-one, because it only allows claiming RGT one block after the distribution has started.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (88)
- rari-capital-launch/rari-ethereum-pool-fund/contracts/lib/pools/KeeperDaoPoolController.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/RariFundToken.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/mstable/IMasset.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/RariFundPriceConsumer.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/RariFundProxy.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/lib/pools/CompoundPoolController.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/RariFundManager.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/RariFundManager.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/aave/LendingPool.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/RariFundController.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/yvault/IVault.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/RariFundManager.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/dydx/lib/Actions.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/compound/CErc20.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/lib/exchanges/ZeroExExchangeController.sol
- rari-capital-launch/rari-yield-pool-contracts/test/fixtures/DummyRariFundManager.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/RariFundToken.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/RariFundPriceConsumer.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/RariFundToken.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/lib/pools/CompoundPoolController.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/lib/pools/YVaultPoolController.sol
- rari-capital-launch/rari-ethereum-pool-fund/test/fixtures/DummyRariFundManager.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/dydx/lib/Actions.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/lib/exchanges/MStableExchangeController.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/RariFundController.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/mstable/MassetStructs.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/lib/pools/DydxPoolController.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/aave/AToken.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/dydx/Getters.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/dydx/lib/Types.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/RariFundController.sol
- rari-capital-launch/rari-governance-contracts/contracts/RariGovernanceToken.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/compound/CErc20.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/Migrations.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/dydx/Getters.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/Migrations.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/RariFundProxy.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/lib/exchanges/ZeroExExchangeController.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/dydx/lib/Account.sol
- rari-capital-launch/rari-governance-contracts/contracts/interfaces/IRariFundManager.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/dydx/SoloMargin.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/dydx/Operation.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/mstable/IMasset.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/lib/pools/CompoundPoolController.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/lib/pools/AavePoolController.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/lib/pools/DydxPoolController.sol
- rari-capital-launch/rari-governance-contracts/contracts/RariGovernanceTokenVesting.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/lib/pools/MStablePoolController.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/dydx/lib/Actions.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/dydx/lib/Account.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/dydx/SoloMargin.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/dydx/lib/Account.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/keeperdao/ILiquidityPool.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/dydx/SoloMargin.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/aave/AToken.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/mstable/ISavingsContract.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/mstable/IBasketManager.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/dydx/lib/Types.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/interfaces/IRariGovernanceTokenDistributor.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/aave/LendingPool.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/mstable/MassetStructs.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/lib/pools/MStablePoolController.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/aave/LendingPool.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/external/dydx/Operation.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/lib/pools/AavePoolController.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/interfaces/IRariGovernanceTokenDistributor.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/dydx/lib/Types.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/lib/exchanges/MStableExchangeController.sol
- rari-capital-launch/rari-ethereum-pool-fund/test/fixtures/DummyRariFundController.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/compound/CEther.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/Migrations.sol
- rari-capital-launch/rari-stable-pool-contracts/test/fixtures/DummyRariFundController.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/dydx/Operation.sol
- rari-capital-launch/rari-governance-contracts/contracts/RariGovernanceTokenDistributor.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/mstable/IBasketManager.sol
- rari-capital-launch/rari-governance-contracts/contracts/interfaces/IRariFundToken.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/dydx/Getters.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/interfaces/IRariGovernanceTokenDistributor.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/lib/exchanges/ZeroExExchangeController.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/keeperdao/IKToken.sol
- rari-capital-launch/rari-governance-contracts/contracts/Migrations.sol
- rari-capital-launch/rari-stable-pool-contracts/test/fixtures/DummyRariFundManager.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/external/aave/AToken.sol
- rari-capital-launch/rari-ethereum-pool-fund/contracts/lib/pools/AavePoolController.sol
- rari-capital-launch/rari-yield-pool-contracts/test/fixtures/DummyRariFundController.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/lib/pools/DydxPoolController.sol
- rari-capital-launch/rari-yield-pool-contracts/contracts/RariFundProxy.sol
- rari-capital-launch/rari-stable-pool-contracts/contracts/external/mstable/ISavingsContract.sol
Part of Rari Capital’s security record
Security firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us