Zoro Protocol

Off-Chain (Public)

Audited on 2024/03/25

No active critical issues

Summary

Zoro Protocol is a decentralized lending protocol, a fork of Compound designed to run on zkSync Era. The changes included the removal of the GovernorAlpha and GovernorBravo contracts, modifying `transfer()` calls to a safer `call()` pattern, and calculating elapsed time with `block.timestamp` rather than `block.number`. The Zoro Protocol uses the ORO token rather than the COMP token for governance. During the audit, we found issues pertaining to unchecked return values for transfers (ZORO-1), borrow rates reflecting old block times (ZORO-2), and privileged roles (ZORO-3). We also list some of the known issues with Compound (ZORO-6). We recommend addressing all issues before deployment. **Fix-Review Update:** All of the issues were addressed or acknowledged. Note that ZORO-6 was addressed by changing the deployment scripts.

Project

Zoro Protocol

Ethereum

Issues (6)

	Low	Medium	High	Critical	Total
Not fixed	4	-	-	-	4
Fixed	2	-	-	-	2
Total	6	0	0	0	6

Contracts (30)

#	Github Repository	Commit Hash	File	Url
1	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/Maximillion.sol	Check on Github
2	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/EIP20NonStandardInterface.sol	Check on Github
3	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/ComptrollerG7.sol	Check on Github
4	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/WhitePaperInterestRateModel.sol	Check on Github
5	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/ComptrollerStorage.sol	Check on Github
6	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/SafeMath.sol	Check on Github
7	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/SimplePriceOracle.sol	Check on Github
8	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/InterestRateModel.sol	Check on Github
9	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/CErc20Delegator.sol	Check on Github
10	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/PriceOracle.sol	Check on Github

#	Github Repository	Commit Hash	File	Url
1	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/Maximillion.sol	Check on Github
2	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/EIP20NonStandardInterface.sol	Check on Github
3	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/ComptrollerG7.sol	Check on Github
4	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/WhitePaperInterestRateModel.sol	Check on Github
5	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/ComptrollerStorage.sol	Check on Github
6	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/SafeMath.sol	Check on Github
7	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/SimplePriceOracle.sol	Check on Github
8	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/InterestRateModel.sol	Check on Github
9	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/CErc20Delegator.sol	Check on Github
10	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/PriceOracle.sol	Check on Github

Zoro Protocol

Summary

Issues (6)

`block.timestamp` May Not Be Futureproofnot_fixed/low

Incorrect Return Value of `getCompAddress()`not_fixed/low

Known Issues in the Compound V2 Protocolnot_fixed/low

Privileged Roles and Ownershipnot_fixed/low

Contracts (30)