dForce Lendi Security Smart Contract Audit

Summary

Executive Summary From March to April 2021, ConsenSys Diligence engaged with dForce to review the dForce Lending Protocol: a pool-based lending platform and stable debt protocol. We conducted this assessment from March 8 to April 9, 2021, and allocated 8 person-weeks over that period. Scope Our review focused on the commit hash 419c2a1e00a74a0590a2e05a959a7c053de4181c. For the most part, the Solidity files at the given commit were in scope. However, one major component was NOT in scope: the pricing oracle implementation, PriceOracle.

Project

dForce

Multi-Chain

No active critical issues

Last audited on 2021/02/28

Auditor

59 audits on Trustblock

Multi-Tags

Issues (12)

	Low	Medium	High	Critical	Total
Not fixed	6	4	2	-	12
Fixed	-	-	-	-	0
Total	6	4	2	0	12

Contracts (29)

#	File Name
11	library/Ownable.sol
12	InterestRateModel/InterestRateModel.sol
13	library/ProxyAdmin.sol
14	interface/IFlashloanExecutor.sol
15	InterestRateModel/StablecoinInterestRateModel.sol
16	interface/IPriceOracle.sol
17	TokenBase/TokenEvent.sol
18	interface/IiToken.sol
19	library/ERC20.sol
20	msd/iMSD.sol

dForce Lending Protocol Review

Summary

Issues (12)

iETH.exchangeRateStored may not be accurate when invoked from external contractsnot_fixed/high

Unbounded loop in Controller.calcAccountEquity allows DoS on liquidationnot_fixed/high

Fix utilization rate computation and respect reserves when lendingnot_fixed/medium

If Base._updateInterest fails, the entire system will haltnot_fixed/medium

MSDController._withdrawReserves does not update interest before withdrawalnot_fixed/medium

Contracts (29)