YFX-V4

In the contract **FundingLogic**, the role **controller** has authority over the following functions: - function updateMaxFundingRate() - function updateMarketPriceFeed() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Update max funding rate to any value and disrupt the funding rate calculation mechanism. - Update market price feed to a malicious contract and disrupt the funding rate calculation mechanism. --- In the contract **InterestLogic**, the role **controller** has authority over the following function: - function updateRatePerHour() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Update max hourly interest rate of any pool, and disrupt the borrow rate calculation mechanism. --- In the contract **InviteManager**, the role **controller** has authority over the following functions: - function setIsUTPPaused() - function setIsURPPaused() - function setUpgradeToken() - function setTradeToken() - function setInviteToken() - function setTier() - function setReferrerTier() - function setCodeOwnerBySystem() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Pause/Unpause the `UTP` mode, which controls whether or not to send `User Trading Proof Token` to traders. - Pause/Unpause the `URP` mode, which controls whether or not to send `User Referral Proof Token` to inviters. - Update the `Update Token` to any new token. - Update the `User Trading Proof Token` to any new token. - Update the `User Referral Proof Token` to any new token. - Update the fee rebate and fee discount of an invitation level. - Update the invitation level of any inviter. A higher invitation level means a higher fee rebate for the inviter and a higher fee discount for the invitee. - Update the invitation code of an user. In the contract **InviteManager**, the role **router** has authority over the following function: - function setTraderReferralCode() Under normal circumstances, the **router** should be the `Router` contract and this would not be a centralization issue. However, if the router is set up maliciously in `Manager` contract, this could lead to hackers being able to tamper with other trader's invitation relationships at will and profit from them. In the contract **InviteManager**, the role **market** has authority over the following functions: - function updateTradeValue() Under normal circumstances, the **market** should be the `Market` contract and this would not be a centralization issue. However, if the market is set up maliciously in `Manager` contract, this could lead to hackers being able to mint `TradeToken` and `InviteToken` at will and profit from them. --- In the contract **Manager**, the role **controller** has authority over the following functions: - function pause() - function unpause() - function modifyExecutor() - function modifyTreasurer() - function modifyOrderNumLimit() - function modifyRouter() - function modifySigner() - function modifyController() - function modifyRiskFunding() - function modifyInterestStatus() - function modifyFundingStatus() - function modifyVault() - function modifyExecuteOrderFee() - function modifyInviteManager() - function modifyMarketPriceFeed() - function modifyMarketLogic() - function modifyCancelElapse() - function modifyCommunityExecuteOrderDelay() - function modifyTriggerOrderDuration() - function createPair() - function setMarketConfig() - function modifyMarketCreateOrderPaused() - function modifyMarketTPSLPricePaused() - function modifyMarketCreateTriggerOrderPaused() - function modifyMarketUpdateMarginPaused() - function modifyExecutorRouter() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Pause/Unpause the `YFX` protocol. - Update the executors. - Update the treasurers who are entitled to use the risk funds at will. If set up as a treasurer, the hacker can drain the risk funds. - Update the maximum number of orders. - Update the `Router` contract, which is a portal of all the user operations. - Update the signers who are entitled to provide the off-chain price and execute orders. If set up as a signer, the hacker can manipulate the price and get profits. - Update the controller who is the super admin of the `YFX` protocol. If set up as the controller, the hacker can do any thing mentioned in this section. - Update the `RiskFunding` contract, which is used to hold the risk funds. If set up as the risk funding contract, the hacker can receive the risk funds when liquidation happens. - Activate/Deactivate the interests module. - Activate/Deactivate the funding module. - Update the `Vault` contract, which is used to hold the market/pool assets. If set up as the vault contract, the ha

There are no upper boundaries for linked functions which is used to set max hourly interests ratio, price provider fee and `executeLiquidateFee`. Those three functions can only be called by the role controller. Any compromise to the controller account may allow the hacker to take advantage of this authority and set the total fee up to any arbitrary amount.

The `increaseMargin` function have a vulnerability that can potentially lead to issues when the contract is paused. Users are unable to add margin during the paused state, which can leave them vulnerable to liquidation if their collateral value falls below the required threshold. Additionally, after the contract is unpaused, users can be subject to frontrunning, where their margin addition transactions can be exploited by other users.

In YFX-V3, the function `setPrices` has been called in the beginning of linked functions before further actions. In v4, the `setPrices` can only be called by price provider and the function call requires a fee when the primary price use pyth price feed.

The converted token amount is calculated based on the token's price provided by Chainlink. There is no validation that the price data is not stale and carried over from a previous round. Stale 'carried over' price can be used for deposit, withdrawal, and maintaining reserved balance. This can cause various types of malfunctions and manipulated liquidations. Chainlink feed has two properties that can help determine if the answer is actual (price is fresh): updatedAt time and answeredInRound. Reference: https://docs.chain.link/data-feeds/historical-data This way ChainLink roundId isn't checked in PriceFeed contract used for price discovery and carried over price is treated as fresh in all tokens conversions related computations.

Division operation may result in precision loss due to rounding down, or even the result being erroneously equal to zero when division by large numbers.

When a contract function accepts native tokens and executes a `.call()` or similar function that also forwards native tokens, it's important to check for and refund any remaining balance. This is because some of the supplied value may not be used during the call execution due to gas constraints, a revert in the called contract, or simply because not all the value was needed. If this remaining balance is not refunded, it will be locked in the contract.

The contract is serving as the underlying entity to interact with one or more third party protocols(`ChainLink`, `Pyth`, `rewardRouter`, different `Tokens`, etc). The scope of the audit treats third party entities as black boxes and assume their functional correctness. However, in the real world, third parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of third parties can possibly create severe impacts, such as increasing fees of third parties, migrating to new LP pools, etc.