KeeperDAO Liquidity Pool and HidingVault

Quantstamp3 Aug 2021Files named in the report

Quantstamp reviewed KeeperDAO Liquidity Pool and HidingVault on 3 Aug 2021: 5 findings, 0 critical; 2 marked fixed, 3 acknowledged.

No open critical findings

Open the report Open KeeperDAO Liquidity Pool and HidingVault’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	3	2

LowInteraction with External ContractsAcknowledged

The protocol relies on functionalities of external contracts. Therefore, security of the project depends on these contracts. While we are unaware of any immediate issues, it is important to note that defi protocols may be vulnerable to flash loan attacks, market manipulation, computational errors, etc. Furthermore, we also want to note that the project assumes constant supply of the external tokens, i.e., inflationary and deflationary tokens are not compatible.

LowMissing argument validationAcknowledged

The constructor of `JITUCore` does not check if arguments are non-zero.

LowPrivileged Roles and OwnershipAcknowledged

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. Specifically: 1. An operator of `LiquidityPool` can call the function `recoverTokens()` at any point in time, to retrieve from the contract any token that is not on the `recoverableTokensBlacklist`. 1. An operator of `LiquidityPool` can call the function `pause()` at any point in time, to pause all the withdrawal requests. 1. An owner of `HidingVaultNFT` can modify any function’s code implementation of all outstanding vaults at will.