Quantstamp reviewed Levva Protocol (Levva Updates and Oracle Feature) on 25 Apr 2024: 10 findings, 0 critical; 8 marked fixed, 1 acknowledged, 1 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 1 | 1 | 4 |
It is important to always round in the protocol's favor to not accrue bad debt. Below we outline minor instances of rounding. Given the `X96` notation, these rounding errors are extremely minor, yet we would still like to point them out. * In `withdrawBase()`, `discountedBaseCollateralDelta` should be rounded up explicitly. Conversely, in `withdrawQuote()`, `discountedQuoteCollateralDelta` should be rounded up explicitly. * In `closePosition()`, `discountedCollateralDelta` should be explicitly rounded up, both in the long and short position case. * In `short()`, `discountedBaseDebtChange` should be explicitly rounded up. Conversely, in `long()`, `discountedQuoteDebtChange` should be explicitly rounded up. * In `depositBase()`, `realBaseDebt`, `discountedQuoteCollDelta`, and the calculation performed in the conditional statement in L476 should be rounded up explicitly. The result of the `mul()`operation for `discountedQuoteCollDelta` at L495 should be rounded up explicitly too. * In `depositQuote()`, `realQuoteDebt` and `discountedBaseCollDelta ` should be rounded up explicitly. * In `liquidate()`, `positionBaseDebt`, `quoteCollToReduce`, `positionQuoteDebt`, and `baseCollToReduce` should be rounded up explicitly. When liquidating a short-position, `disQuoteDelta` should be explicitly rounded up. When liquidating long-positions, `disBaseDelta` should be explicitly rounded up. * In `enactMarginCall()`, the multiplication performed for `realBaseDebt` and `realQuoteDebt` should be rounded up explicitly. * In `sellBaseForQuote()`, the multiplication performed for `realQuoteDebt` should be rounded up. Conversely, in `sellQuoteForBase()`, `realBaseDebt` should be rounded up explicitly. * In `accrueInterest()`, the multiplications performed for `realBaseDebtPrev` and `realQuoteDebtPrev` should be rounded up explicitly. * In `calcRealBaseCollateral()`, the result of `baseDelevCoeff.mul(disQuoteDebt)` should be rounded up explicitly. Conversely, in `calcRealQuoteCollateral()`, the result of `quoteDelevCoeff.mul(disBaseDebt)` should be rounded up explicitly. * In `positionHasBadLeverage()`, all multiplications performed between `FP96.FixedPoint` and `uint256` for `realTotalDebt` should be rounded up explicitly. * In `updateHeap()` in the short case, `initialPrice.mul(position.discountedBaseAmount)` should be round up explicitly. * In `receivePosition()`, the multiplications performed for `badPositionBaseDebt` and `badPositionQuoteDebt` should be rounded up explicitly. * In `shutDown()`, the result of `basePrice.mul(baseDebt)` in L1271 should be rounded up explicitly. * In `setEmergencyMode()`, the result of `shutDownPrice.mul(emergencyDebt)` should be rounded up explicitly. * In `emergencyWithdraw()`, the multiplications performed for `positionBaseNet` and `positionQuoteNet` should be rounded up explicitly. * In `updateSystemLeverageLong()`, `realQuoteDebt` should be rounded up. Conversely, in `updateSystemLeverageShort()` both multiplications performed for `realBaseDebt` should be rounded up explicitly. In both functions, `leverageX96` should be rounded up explicitly.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (2)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us