ClayStack

Quantstamp26 Sep 2022Files named in the report

Audit

Quantstamp reviewed ClayStack on 26 Sep 2022: 12 findings, 0 critical; 6 marked fixed, 6 acknowledged.

No open critical findings

Open the report Open ClayStack’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	0
Low	6	6

LowBlock Timestamp ManipulationAcknowledged

Projects may rely on block timestamps for various purposes. However, it's important to realize that miners individually set the timestamp of a block, and attackers may be able to manipulate timestamps for their own purposes. If a smart contract relies on a timestamp, it must take this into account.

LowFees May Be UninitializedAcknowledged

Fees are charged when users deposit, withdraw, instantly withdraw, or make an early claim on funds. However, the only fee guaranteed to be initialized is the deposit fee. If the remaining fees remain uninitialized for any transactions, the protocol may lose out on earnings.

LowReliance on `clayTunnel` to Be Working as ExpectedAcknowledged

The `ClayManager._exchangeCsToken()` for calculating how many MATIC can be exchanged from a certain amount of csMatic tokens. This procedure totally relies on the security, correctness, and stability of `clayTunnel.getFunds()`. An incorrect rate could lead to devastating consequences.

LowReliance on Off-Chain Component to Be Working as ExpectedAcknowledged

The `UserProxy` contract is responsible for completing the process of a batch order that is specified by `batchID` in polygon, using the functions below: 1. `UserProxy.deposit()` 2. `UserProxy.withdraw()` These functions are designed and expected to be called only once by the tunnel. The tunnel is expected to guard against replay attacks. However, we note that it is outside the scope of this audit.

LowTimelock Should Allow Adequate Time for Users to ExitAcknowledged

Some functions in `ClayManager` are restricted to the `TIMELOCK_ROLE` and `TIMELOCK_UPGRADES_ROLE`. This gives users time to exit before a potentially dangerous change is applied. However, with withdrawals potentially taking several days before they can be claimed, it is important that the timelock be configured such that users have adequate time to complete their exit if they choose to do so.

LowUpgradabilityAcknowledged

Many contracts within the project are upgradeable. While this is not a vulnerability, users should be aware that the behavior of the contracts could drastically change if the contracts are upgraded. Furthermore, new vulnerabilities not present during the audit could be introduced in upgraded versions of the contract, or if contract upgrade deployments are not done correctly.