LI.FI

Quantstamp5 May 2022Files named in the report

Audit

Quantstamp reviewed LI.FI on 5 May 2022: 10 findings, 0 critical; 5 marked fixed, 4 acknowledged, 1 open.

No open critical findings

Open the report Open LI.FI’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	1	0	0
Medium	0	0	1
Low	0	4	4

Medium`jlength` Not Updated After a DEX is Removed From the StorageFixed

On `L95` in `src/Facets/DexManagerFacet.sol`, the `jlength` is never updated after a DEX is removed from the storage using `_removeDex(j)`.

LowClone-And-OwnFixed

LiFinance project uses the EIP-2535 standard implementation. In the related documentation (`docs/LibDiamond.md`) is stated that is copied from the proposed implementation of the EIP author: `mudgen/diamond-1-hardhat` GitHub repository. However, we found that the files have minor differences between them.

LowEvents Should Be Emitted In Critical OperationsFixed

Several contracts implement an "initializer" function. These functions can be called many times, modifying the storage of the contract. This includes critical variables, such as addresses pointing to tokens and bridges. The execution of these functions should emit events to track misuse. `CBridgeFacet` emits `Inited` event (declared in `ILiFi` interface) when initialized. However, `HopFacet`, `HyphenFacet` and `NXTPFacet` contracts do not emit events when initialized or when critical changes are made.

LowTwo Versions Of `Swapper.sol`Fixed

We noticed that there are two files named `Swapper.sol` with similar functionality. Observing the git history, we think that `src/Facets/Swapper.sol` was not removed when refactored into `src/Helpers/Swapper.sol`. Also, no contract imports or inherits from `src/Facets/Swapper.sol` (i.e., this file is never used). This can lead to confusion and unexpected behavior if a contract imports the wrong file.

LowUnlocked PragmaFixed

Every Solidity file specifies in the header a version number of the format pragma solidity (^)0.8.*. The caret (^) before the version number implies an unlocked pragma, meaning that the compiler will use the specified version and above, hence the term "unlocked".