Secured Finance - Diff Audit

QuantstampRepository at commit f1c6276

Audit · firm’s term: audit

Quantstamp reviewed Secured Finance (Secured Finance - Diff Audit) on 29 Mar 2024: 14 findings, 0 critical; 9 marked fixed, 5 acknowledged.

No open critical findings
Open the reportOpen Secured Finance’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings14

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium002
Low057
LowBorrowing Users Increase Their Liquidation Risk when Minting `ZCTokens`Acknowledged

Users can become close to being liquidated if they have ZC bonds that are used as collateral and convert their maximum balance of the withdrawable amount. In this extreme case, a liquidation can happen in the next block if a slight update of the price happens.

LowDeposits with Permits Can Be Delayed by Front-Running the ApprovalAcknowledged

When a user calls a function that uses permit signatures to approve the tokens for deposit, the signature parameters can be pulled from the the mempool and used to approve the token directly. Since the permit signature uses nonce protection, the original function call would fail if someone else used the signature first. This affects all functions that use `permit()` to approve tokens before transferring them.

LowHaircuts in Deployed Contract Have Zero Values for All CurrenciesAcknowledged

The functions `LendingMarketUserLogic._getWithdrawableAmount()` and `FundManagementLogic.calculateFunds()` apply haircuts to values, which are stored in the `CurrencyController` contract. However, all the currencies in the deployed contract at `0x7dca6b6BF30cd28ADe83e86e21e82e3F852bF2DC` (address taken from the [docs](https://docs.secured.finance/technical-guide/deployed-contracts)) have zero values as their haircuts. This may lead to unwanted consequences when risk management is required while valuing user assets.

LowPrivileged Roles and OwnershipAcknowledged

In addition to the roles described in the previous audit report, the owner can create new ZCTokens.

LowSome Erc20 Tokens Do Not Support Transfers with Permission SignaturesAcknowledged

The new version of the codebase brings two additional functions letting users deposit tokens to the contract using permission signatures (ERC2612). However, not all tokens support this feature. Worse, few ERC20 tokens such as WETH can offer a `fallback()` function that will lead to any attempt to execute the function `permit()` on this contract to silently fail (concept of phantom functions). Even if right now, no concrete impact was found since only `msg.sender` can originate a signature that will transfer tokens from its address, silent failures should be avoided.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (77)

  • https://github.com/Secured-Finance/contracts/contracts/protocol/mixins/MixinLiquidationConfiguration.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/ERC20Upgradeable.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/ITokenVault.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/OrderActionLogic.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/EIP712Upgradeable.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/mixins/MixinWallet.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/mixins/MixinAddressResolverStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/ICurrencyController.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/LendingMarketController.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/ZCTokenStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/utils/ERC20PermitUpgradeableStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/utils/PausableStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/CurrencyControllerStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IReserveFund.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/AddressResolverLib.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/ProxyController.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/ILendingMarketController.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/types/ProtocolTypes.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/utils/EIP712UpgradeableStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/LiquidationLogic.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/OrderStatisticsTreeLib.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/libraries/TransferHelperStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/FutureValueVault.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/OrderReaderLogic.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/DepositManagementLogic.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/ZCToken.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/BokkyPooBahsDateTimeLibrary.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IProxyController.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IGenesisValueVault.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IAddressResolver.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/CurrencyController.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/BeaconProxyController.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/ReserveFund.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/utils/ERC20UpgradeableStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/GenesisValueVaultStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IZCToken.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/Proxyable.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/BeaconProxyControllerStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/mixins/MixinLendingMarketConfiguration.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/UpgradeableBeacon.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/UpgradeabilityProxy.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/INativeToken.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/AddressResolverStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/AccessControl.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/ILiquidationReceiver.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/QuickSort.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/TransferHelper.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/OrderBookLogic.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/Contracts.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/TokenVault.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/GenesisValueVault.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/OrderBookLib.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/math/RoundingUint256.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/utils/OwnableStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/LendingMarketControllerStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/math/RoundingInt256.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/LendingMarket.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/LendingMarketUserLogic.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IBeaconProxyController.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/LendingMarketOperationLogic.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/ERC20PermitUpgradeable.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/LockAndMsgSender.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/utils/AccessControlStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/ILendingMarket.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/Pausable.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/mixins/MixinAccessControl.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/ReserveFundStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/LendingMarketStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/FutureValueVaultStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/Constants.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/mixins/MixinAddressResolver.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/UpgradeabilityBeaconProxy.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/storages/TokenVaultStorage.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/utils/Ownable.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/AddressResolver.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/interfaces/IFutureValueVault.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b
  • https://github.com/Secured-Finance/contracts/contracts/protocol/libraries/logics/FundManagementLogic.sol at commit f1c62764ccf9782b2ff2de5088abc439566b7a0b

Part of Secured Finance’s security record

Secured Finance
Audits2 audits by 1 firmLast audit Mar 2024, by Quantstamp.
Critical findingsNo open critical findingsAcross 2 reports.
Open Secured Finance’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us