Hifi Finance

Quantstamp21 Oct 2022Files named in the report

Quantstamp reviewed Hifi Finance on 21 Oct 2022: 31 findings, 0 critical; 7 marked fixed, 22 acknowledged, 2 open.

No open critical findings

Open the report Open Hifi Finance’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings31

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	1	9	5
Low	1	13	2

MediumUnbounded Iteration on Collateral AssetsOpen

Many functions within the `BalanceSheetV2` contract call the `BalanceSheetV2.getHypotheticalAccountLiquidity()` in order to determine whether the user's liquidity is healthy. The `BalanceSheetV2.getHypotheticalAccountLiquidity()` function iterates over all collateral and bond tokens held by the vault. The number of bonds a vault holds is limited by an upper bound `maxBonds` defined within the `Fintroller` contract. However, the number of different collateral assets held by the vault is not bounded. The unbounded iteration could lead to any function which relies on the `BalanceSheetV2.getHypotheticalAccountLiquidity()` function running out of gas. This will result in the complete unusability of the vault and the inability to recover any funds stored within it. The same issue exists for the `internal` function `BalanceSheetV2.removeCollateralFromList()`, which may also iterate over every collateral the vault holds.

LowUnlocked PragmaOpen

Every Solidity file specifies in the header a version number of the format `pragma solidity >=0.8.4`. The `>=` before the version number implies an unlocked pragma, meaning that the compiler will use the specified version _and above_, hence the term "unlocked".

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (33)

packages/protocol/contracts/core/balance-sheet/IBalanceSheetV2.sol
packages/amm/contracts/math/YieldSpace.sol
packages/protocol/contracts/core/fintroller/Fintroller.sol
packages/protocol/contracts/oracles/ChainlinkOperator.sol
packages/amm/contracts/HifiPool.sol
packages/protocol/contracts/access/IOwnableUpgradeable.sol
packages/protocol/contracts/test/BalanceSheetUpgraded.sol
packages/protocol/contracts/test/GodModeHToken.sol
packages/protocol/contracts/core/balance-sheet/SBalanceSheetV1.sol
packages/protocol/contracts/test/GodModeBalanceSheet.sol
packages/amm/contracts/test/GodModeHifiPool.sol
packages/amm/contracts/IHifiPoolRegistry.sol
packages/protocol/contracts/oracles/SimplePriceFeed.sol
packages/protocol/contracts/external/chainlink/IAggregatorV3.sol
packages/protocol/contracts/core/balance-sheet/BalanceSheetV2.sol
packages/protocol/contracts/core/h-token/IHToken.sol
packages/protocol/contracts/core/fintroller/IFintroller.sol
packages/protocol/contracts/test/GodModeOwnableUpgradeable.sol
packages/amm/contracts/HifiPoolRegistry.sol
packages/protocol/contracts/access/OwnableUpgradeable.sol
packages/protocol/contracts/core/h-token/HToken.sol
packages/amm/contracts/IHifiPool.sol
packages/protocol/contracts/test/GodModeErc20.sol
packages/proxy-target/contracts/external/WethInterface.sol
packages/amm/contracts/test/GodModeErc20.sol
packages/proxy-target/contracts/HifiProxyTarget.sol
packages/amm/contracts/test/GodModeHToken.sol
packages/protocol/contracts/oracles/IChainlinkOperator.sol
packages/protocol/contracts/oracles/StablecoinPriceFeed.sol
packages/amm/contracts/test/YieldSpaceMock.sol
packages/protocol/contracts/core/balance-sheet/SBalanceSheetV2.sol
packages/amm/contracts/test/GodModeHifiPoolRegistry.sol
packages/proxy-target/contracts/IHifiProxyTarget.sol

Part of Hifi Finance’s security record

Hifi Finance

Audits1 audit by 1 firmLast audit Oct 2022, by Quantstamp.

Critical findingsNo open critical findingsIn 1 report.

Open Hifi Finance’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.