Levva Updates and Oracle Feature

QuantstampFiles named in the report

Quantstamp reviewed Levva Protocol (Levva Updates and Oracle Feature) on 25 Apr 2024: 10 findings, 0 critical; 8 marked fixed, 1 acknowledged, 1 open.

No open critical findings
Open the reportOpen Levva Protocol’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium003
Low114
LowNotes on Oracle Price Update DelaysAcknowledged

Chainlink and Pyth aggregate prices off-chain and update the price value periodically on-chain. By design this creates a minor price update delay that has different impacts on each protocol. It is worth noting that also using an on-chain TWAP can cause a similar delay if the `secondsAgo` is set to a sufficiently large value. Below, we would like to outline how the slight price delays can impact Marginly: 1. A lender or a holder of an active position of the opposite side could avoid absorbing bad debt with their collateral by front-running a significant price update with a withdrawal or position close that would else cause net negative liquidations 1. Theoretically, users could benefit from slightly decreased APYs until the next oracle update, in case the last reported price causes leverage calculations to increase. 1. Theoretically, users could front run price updates by opening a highly leveraged position with the asset that is about to get the APY increased in its favor. As soon as the price update is recorded and the increased interest is accounted for in retrospect, the position could be closed. It is worth highlighting that both of these scenarios are quite unlikely and unlikely to be profitable. The first one in a worst-case analysis of a maximally leveraged position that is almost underwater requires a price increase of more than 0.25% between two oracle updates for bad debt to accumulate, while the second and third one have a theoretical opportunity window of increased APY equal to the period of the price updates, which is maximally in the realm of minutes.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (2)

  • packages/periphery/contracts/oracles/**
  • packages/contracts/contracts/**

Part of Levva Protocol’s security record

Levva Protocol
Audits2 audits by 1 firmLast audit Apr 2024, by Quantstamp.
Critical findingsNo open critical findingsAcross 2 reports.
Open Levva Protocol’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us