Quantstamp reviewed Levva Protocol (Levva Updates and Oracle Feature) on 25 Apr 2024: 10 findings, 0 critical; 8 marked fixed, 1 acknowledged, 1 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 1 | 1 | 4 |
Chainlink and Pyth aggregate prices off-chain and update the price value periodically on-chain. By design this creates a minor price update delay that has different impacts on each protocol. It is worth noting that also using an on-chain TWAP can cause a similar delay if the `secondsAgo` is set to a sufficiently large value. Below, we would like to outline how the slight price delays can impact Marginly: 1. A lender or a holder of an active position of the opposite side could avoid absorbing bad debt with their collateral by front-running a significant price update with a withdrawal or position close that would else cause net negative liquidations 1. Theoretically, users could benefit from slightly decreased APYs until the next oracle update, in case the last reported price causes leverage calculations to increase. 1. Theoretically, users could front run price updates by opening a highly leveraged position with the asset that is about to get the APY increased in its favor. As soon as the price update is recorded and the increased interest is accounted for in retrospect, the position could be closed. It is worth highlighting that both of these scenarios are quite unlikely and unlikely to be profitable. The first one in a worst-case analysis of a maximally leveraged position that is almost underwater requires a price increase of more than 0.25% between two oracle updates for bad debt to accumulate, while the second and third one have a theoretical opportunity window of increased APY equal to the period of the price updates, which is maximally in the realm of minutes.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (2)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us