Level Finance

Quantstamp29 Mar 2023Files named in the report

Quantstamp reviewed Level (Level Finance) on 29 Mar 2023: 32 findings, 0 critical; 14 marked fixed, 15 acknowledged, 3 open.

No open critical findings

Open the report Open Level’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings32

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	0	4
Medium	2	1	2
Low	0	14	8

HighTechnical Documentation and Tests Are Severely LackingOpen

The protocol is overall underdocumented and underspecified. With a codebase so large and interconnected, there is a distinct need for documentation that can explain the purpose of each contract and how they fit together. Moreover, there is no technical specification to describe how the system should work as a whole. In the absence of such documentation, client-authored test suites are often used in order to arrive at something resembling a list of functional requirements. However, given the almost-entire absence of tests for the two audited repositories, this was not possible during the audit. In light of the above, communication with the client was pursued extensively in order to clarify design decisions and intended behaviour. However, this level of communication rarely suffices to alleviate problems caused by a lack of documentation. As a result, the audit was significantly impaired. Furthermore, the lack of tests increases operational risk for Level Finance, especially given the layered contract calls and interactions. Proper configuration is key for ensuring intended functionality, and yet there are no post-deployment checks.

MediumNo Limit on Position Size with Current Timelock Configuration Enables Unstoppable Theft of Funds From PoolOpen

In LEV-9, we detailed that all LP funds can be locked in the pool for a period of time because of traders who open positions of sufficiently large size. In LEV-8, we detailed that the `Timelock` contract has only a 12-hour delay and has the ability to upgrade the `Pool` contract, allowing for funds to be stolen by the Level Finance team. Together, these issues form the basis for an attack that would allow the Level Finance team to lock all the LP funds and drain them through a coordinated contract upgrade.

MediumPool Upgrade Can Enable Unexpected Loss or Theft of FundsOpen

After a 12 hour delay, the timelock can change the `ProxyAdmin`'s owner to a different address, allowing indiscriminate upgrading of the Pool. It is possible for such an upgrade to result in the loss of all the funds in the Pool, or to otherwise enrich the Timelock admin to the exclusion of the LPs. 12 hours is insufficient time to react to the queuing of an upgrade transaction.