Levva Updates and Oracle Feature

QuantstampFiles named in the report

Quantstamp reviewed Levva Protocol (Levva Updates and Oracle Feature) on 25 Apr 2024: 10 findings, 0 critical; 8 marked fixed, 1 acknowledged, 1 open.

No open critical findings
Open the reportOpen Levva Protocol’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium003
Low114
LowMinor Incorrect RoundingsOpen

It is important to always round in the protocol's favor to not accrue bad debt. Below we outline minor instances of rounding. Given the `X96` notation, these rounding errors are extremely minor, yet we would still like to point them out. * In `withdrawBase()`, `discountedBaseCollateralDelta` should be rounded up explicitly. Conversely, in `withdrawQuote()`, `discountedQuoteCollateralDelta` should be rounded up explicitly. * In `closePosition()`, `discountedCollateralDelta` should be explicitly rounded up, both in the long and short position case. * In `short()`, `discountedBaseDebtChange` should be explicitly rounded up. Conversely, in `long()`, `discountedQuoteDebtChange` should be explicitly rounded up. * In `depositBase()`, `realBaseDebt`, `discountedQuoteCollDelta`, and the calculation performed in the conditional statement in L476 should be rounded up explicitly. The result of the `mul()`operation for `discountedQuoteCollDelta` at L495 should be rounded up explicitly too. * In `depositQuote()`, `realQuoteDebt` and `discountedBaseCollDelta ` should be rounded up explicitly. * In `liquidate()`, `positionBaseDebt`, `quoteCollToReduce`, `positionQuoteDebt`, and `baseCollToReduce` should be rounded up explicitly. When liquidating a short-position, `disQuoteDelta` should be explicitly rounded up. When liquidating long-positions, `disBaseDelta` should be explicitly rounded up. * In `enactMarginCall()`, the multiplication performed for `realBaseDebt` and `realQuoteDebt` should be rounded up explicitly. * In `sellBaseForQuote()`, the multiplication performed for `realQuoteDebt` should be rounded up. Conversely, in `sellQuoteForBase()`, `realBaseDebt` should be rounded up explicitly. * In `accrueInterest()`, the multiplications performed for `realBaseDebtPrev` and `realQuoteDebtPrev` should be rounded up explicitly. * In `calcRealBaseCollateral()`, the result of `baseDelevCoeff.mul(disQuoteDebt)` should be rounded up explicitly. Conversely, in `calcRealQuoteCollateral()`, the result of `quoteDelevCoeff.mul(disBaseDebt)` should be rounded up explicitly. * In `positionHasBadLeverage()`, all multiplications performed between `FP96.FixedPoint` and `uint256` for `realTotalDebt` should be rounded up explicitly. * In `updateHeap()` in the short case, `initialPrice.mul(position.discountedBaseAmount)` should be round up explicitly. * In `receivePosition()`, the multiplications performed for `badPositionBaseDebt` and `badPositionQuoteDebt` should be rounded up explicitly. * In `shutDown()`, the result of `basePrice.mul(baseDebt)` in L1271 should be rounded up explicitly. * In `setEmergencyMode()`, the result of `shutDownPrice.mul(emergencyDebt)` should be rounded up explicitly. * In `emergencyWithdraw()`, the multiplications performed for `positionBaseNet` and `positionQuoteNet` should be rounded up explicitly. * In `updateSystemLeverageLong()`, `realQuoteDebt` should be rounded up. Conversely, in `updateSystemLeverageShort()` both multiplications performed for `realBaseDebt` should be rounded up explicitly. In both functions, `leverageX96` should be rounded up explicitly.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (2)

  • packages/periphery/contracts/oracles/**
  • packages/contracts/contracts/**

Part of Levva Protocol’s security record

Levva Protocol
Audits2 audits by 1 firmLast audit Apr 2024, by Quantstamp.
Critical findingsNo open critical findingsAcross 2 reports.
Open Levva Protocol’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us