AlphaHomoraV2

Quantstamp11 Dec 2020Files named in the report

Audit

Quantstamp reviewed AlphaHomoraV2 on 11 Dec 2020: 15 findings, 0 critical; 10 marked fixed, 4 acknowledged, 1 open.

No open critical findings

Open the report Open AlphaHomoraV2’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings15

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	4
Medium	0	0	2
Low	1	4	4

Low`HomoraBank` may not be able to return borrowed funds to integrated lending protocols during flash crashAcknowledged

During a flash crash, the price of assets drop suddenly. Under this condition, the liquidators might not be fast enough (or incentivized enough) to liquidate the collaterals. Even eventually the liquidators successfully liquidate all the collaterals, the liquidation price could be very low and the amount of borrowed token being repaid could be unexpectedly small. This might cause `HomoraBank` contract to hold insufficient amounts of borrowed tokens that can be used to repay the debt. **2020-12-18 update**: Alpha team stated that collateral and borrow factor will be set appropriately in order to serve as a buffer when price drops suddenly.

LowNo fallback oracle if primary fails.Acknowledged

If Keep3r workers stop updating their oracles due to on-chain or off-chain problems, or any of those services is killed by their organizations, `BaseKP3ROracle` has no alternative source of prices and most services of `HomoraBank` such as main `execute()` service stops working. **2020-12-18 update**: Alpha team stated that they will add a secondary oracle later.

LowPrivileged RolesAcknowledged

(a) The `governor` of contract `contracts/HomoraBank.sol` can use the function `withdrawReserve` to withdraw any amount of tokens from the contract. (c) The `governor` of contract `contracts/oracle/ProxyOracle.sol` can manipulate the price oracles that are used in the system, at any time. (b) The `governor` of contract `contracts/oracle/SimpleOracle.sol` can manipulate the price data used in the system, at any time. **2020-12-18 update**: Alpha team stated that they will communicate this information with end-users.

LowTransmit arbitrary amount of token from a position owner to a spell contract and get lockedAcknowledged

`contracts/HomoraBank.sol`: function `transmit` can be called by a position owner through the function `HomoraCaster.cast` and transfer any amount of token to the `target` address specified when calling `HomoraCaster.cast()`. Users could lose their fund if there are no methods in the destination spell contract that can send the asset back. **2020-12-18 update**: Alpha team stated that they will communicate the best practice of writing good spells with end-users, and make sure the ones provided by Alpha team will be audited.