Archi Finance
Summary
Archi Finance is a GLP yield farming protocol. It promises lenders low-risk interest for supplying single-asset liquidity and borrowers the opportunity to farm with 10x leverage on GMX. It should be noted that all GMX contracts are outside the scope of this audit. We have found an extensive number of high-severity issues. Lenders are not guaranteed to be able to withdraw their provided liquidity (ARC-2). This vulnerability is furthered by the lack of liquidation incentives, and in some cases, the inability to liquidate defaulted positions (ARC-3 & ARC-11). The contracts also contain vulnerabilities surrounding insufficient access control (ARC-5 & ARC-6) and locked funds (ARC-12, ARC-16, & ARC-19). No testing suite was provided and thus confidence in the security and correctness of the contracts cannot be established. Testing recommendations have been outlined in ARC-1. In its current state, we cannot recommend the deployment or the use of the Archi Finance protocol until it assures solvency for lenders with properly collateralized loans and liquidations. **Update:** The protocol has undergone several updates. Most notably, the liquidation mechanism has been revamped to lock a liquidation fee when users open a position so as to maintain liquidation incentives (ARC-3, ARC-10, ARC-38, ARC-47). Further restrictions have been added on how long and how often borrowers can open a position, as well as the ability to parameterize the rewards ratio between the borrowers and liquidity providers (ARC-2). Whilst this does not guarantee that liquidity providers will always be able to withdraw their liquidity at any moment, this should better help align incentives for sufficient liquidity to be available. A testing suite has been added and the documentation has been updated (ARC-1 & ARC-9).
Issues (50)
Low | Medium | High | Critical | Total | |
|---|---|---|---|---|---|
Not fixed | 6 | - | 2 | - | 8 |
Fixed | 25 | 8 | 9 | - | 42 |
| Total | 31 | 8 | 11 | 0 | 50 |