Zoro Protocol
Summary
Zoro Protocol is a decentralized lending protocol, a fork of Compound designed to run on zkSync Era. The changes included the removal of the GovernorAlpha and GovernorBravo contracts, modifying `transfer()` calls to a safer `call()` pattern, and calculating elapsed time with `block.timestamp` rather than `block.number`. The Zoro Protocol uses the ORO token rather than the COMP token for governance. During the audit, we found issues pertaining to unchecked return values for transfers (ZORO-1), borrow rates reflecting old block times (ZORO-2), and privileged roles (ZORO-3). We also list some of the known issues with Compound (ZORO-6). We recommend addressing all issues before deployment. **Fix-Review Update:** All of the issues were addressed or acknowledged. Note that ZORO-6 was addressed by changing the deployment scripts.
Issues (6)
Low | Medium | High | Critical | Total | |
|---|---|---|---|---|---|
Not fixed | 4 | - | - | - | 4 |
Acknowledged | - | - | - | - | 0 |
Fixed | 2 | - | - | - | 2 |
| Total | 6 | 0 | 0 | 0 | 6 |