dForce Lending Protocol Review

ConsensysFiles named in the report

Audit · firm’s term: review

Consensys reviewed dForce (dForce Lending Protocol Review) on 1 Mar 2021: 12 findings, 0 critical; none marked fixed.

No open critical findings
Open the reportOpen dForce’s security record

Report hosted on diligence.security.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High200
Medium400
Low600
HighiETH.exchangeRateStored may not be accurate when invoked from external contractsOpen

The report gives no description here.

HighUnbounded loop in Controller.calcAccountEquity allows DoS on liquidationOpen

The report gives no description here.

MediumFix utilization rate computation and respect reserves when lendingOpen

The report gives no description here.

MediumIf Base._updateInterest fails, the entire system will haltOpen

The report gives no description here.

MediumMSDController._withdrawReserves does not update interest before withdrawalOpen

The report gives no description here.

MediumRewardDistributor requirement prevents transition of Owner role to smart contractOpen

The report gives no description here.

LowAvoid code duplicationOpen

The report gives no description here.

LowEnsure users have a clear understanding of what “Collateral” meansOpen

The report gives no description here.

LowiETH.receive() does not support contracts executing during their constructorOpen

The report gives no description here.

Lowpermit functions use deployment-time instead of execution-time chain IDOpen

The report gives no description here.

Show 2 more
LowPlan and test the Owner in real-world scenarios, including an eventual transition to a smart contractOpen

The report gives no description here.

LowShort-circuit Base._updateInterest by returning early if accrualBlockNumber == block.numberOpen

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (29)

  • interface/IPriceOracle.sol
  • iToken.sol
  • library/Initializable.sol
  • library/ReentrancyGuard.sol
  • RewardDistributor.sol
  • interface/IInterestRateModelInterface.sol
  • iETH.sol
  • TokenBase/TokenAdmin.sol
  • TokenBase/Base.sol
  • TokenBase/TokenERC20.sol
  • msd/iMSD.sol
  • library/ERC20.sol
  • interface/IiToken.sol
  • TokenBase/TokenEvent.sol
  • msd/MSD.sol
  • InterestRateModel/StablecoinInterestRateModel.sol
  • interface/IFlashloanExecutor.sol
  • library/ProxyAdmin.sol
  • InterestRateModel/InterestRateModel.sol
  • library/Ownable.sol
  • interface/IRewardDistributor.sol
  • TokenBase/TokenStorage.sol
  • Controller.sol
  • interface/IControllerInterface.sol
  • msd/MSDController.sol
  • library/SafeRatioMath.sol
  • InterestRateModel/FixedInterestRateModel.sol
  • msd/MSDS.sol
  • InterestRateModel/StandardInterestRateModel.sol

Part of dForce’s security record

dForce
Audits2 audits by 2 firmsLast audit Mar 2021, by Consensys.
Critical findingsNo open critical findingsAcross 2 reports.
IncidentIncident 9 Feb 2023Source: De.Fi incident database.
Open dForce’s security record

Security firm

Consensys

41 projects reviewed · 59 reports · latest Oct 2024

See Consensys’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us