Part of CertiK’s series
CertiK reviewed Venus Protocol (Venus - PendleOracle Upgrade) on 26 Dec 2024: 3 findings, 0 critical; 2 marked fixed, 1 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 1 | 0 | 1 |
The function `_getUnderlyingAmount()` is designed to get the `underlyingToken` amount for 1 `ptToken` scaled by the `underlyingToken` decimals. However, this function simply returns the value obtained from the `PT_ORACLE`, which does not always have this scaling and can result in an incorrect price being returned. For example lets assume that PT pumpBTC 27MAR2025 is to be supported [0x997Ec6Bf18a30Ef01ed8D9c90718C7726a213527](https://etherscan.io/address/0x997Ec6Bf18a30Ef01ed8D9c90718C7726a213527). If one uses the `PendlePtLpOracle` at address [0x66a1096C6366b2529274dF4f5D8247827fe4CEA8](https://etherscan.io/address/0x66a1096C6366b2529274dF4f5D8247827fe4CEA8) (currently used by Venus) and fetches the rate via the pumpBTC market [0x8098b48a1c4e4080b30a43a7ebc0c87b52f17222](https://etherscan.io/address/0x8098b48a1c4e4080b30a43a7ebc0c87b52f17222), it will return a value with 18 decimals of precision, however WBTC only has 8 decimals. This would result in the wrong price being returned. In our testing when calling `PT_ORACLE.getPtToAssetRate(0x8098b48a1c4e4080b30a43a7ebc0c87b52f17222, 900)` we got a value of `988245041751264715`, which is scaled by 1e18 as opposed to 1e8.
The comment above `_getUnderlyingAmount()` was updated to state that it fetches the amount of underlying or SY token for 1 pendle token. However, this may be misunderstood, because in the case that `RATE_KIND == PT_TO_SY` the `underlyingToken` should be set to the SY token.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (2)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us