Zoro Protocol
Quantstamp reviewed Zoro Protocol on 31 Jan 2024: 6 findings, 0 critical; 2 marked fixed, 3 acknowledged, 1 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings6
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 1 | 3 | 2 |
LowKnown Issues in the Compound V2 ProtocolOpen
The following is a non-exhaustive list of existing or known issues in the Compound V2 codebase: 1. Empty market vulnerability: An empty market (i.e., cToken with a total supply of 0) is vulnerable to exchange rate manipulation that may lead to loss of funds in other markets managed by the same Comptroller. See [Compound's analysis](https://www.comp.xyz/t/hundred-finance-exploit-and-compound-v2/4266) on the Hundred Finance Incident for more details. This vulnerability can be triggered not only when a market is empty but also when an adversary controls the entire token supply of a market by, e.g., liquidating other users' positions. 1. Similar to the empty market vulnerability, if the underlying token of a market is compromised, the adversary might be able to drain the funds in other markets by inflating the underlying token balance in the cToken contract (and therefore the return value of `getCash()` and the exchange rate) with a low cost. 1. Some ERC-20 tokens are incompatible with the Compound V2 codebase and might cause issues when used as an underlying token. For example, tokens with transfer hooks (e.g., ERC-777), double-entry tokens (e.g., TUSD in the past), and tokens allowing balance changes without a transfer (e.g., rebasing tokens). 1. The `repayBorrowBehalf()` function in the `CEther` and `CErc20` contract allows a user to repay the entire borrow balance of another by specifying the `repayAmount` as `type(uint).max`. This could open an attack vector where the borrower front-runs the repayment transaction and increases the borrow balance, causing the repayer to spend more than expected. 1. In `CToken.mintFresh()`, the call to `comptroller.mintVerify()` is commented out, and the `comptroller.repayBorrowVerify()` function is never used in the codebase. Therefore, modifications to the `mintVerify()` or `repayBorrowVerify()` functions will not take any effect. 1. `Comptroller._supportMarket()` calls `isCToken()` on the provided `cToken` parameter but does not validate the return value as `true`. `Comptroller._setPriceOracle()` does not call `isPriceOracle()` on `newOracle` to check that the provided address implements a `PriceOracle`. 1. The `repayBorrow()`, `repayBorrowBehalf()`, `liquidateBorrow()`, and `mint()` functions in the `CEther` contract do not return a boolean, while the same functions in the `CErc20` contract do. Third-party contracts integrating with the `CEther` contract should be aware of such discrepancies.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (30)
- https://github.com/zoro-protocol/zoro-protocol/contracts/ComptrollerInterface.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/ErrorReporter.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/DAIInterestRateModelV3.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/Reservoir.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/CEther.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/JumpRateModelV2.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/JumpRateModel.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/CTokenInterfaces.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/Governance/Comp.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/EIP20Interface.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/ExponentialNoError.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/Unitroller.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20Immutable.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20Delegate.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/Maximillion.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/BaseJumpRateModelV2.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/Lens/CompoundLens.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/Comptroller.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/CToken.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/CDaiDelegate.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/PriceOracle.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20Delegator.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/InterestRateModel.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/SimplePriceOracle.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/SafeMath.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/ComptrollerStorage.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/WhitePaperInterestRateModel.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/ComptrollerG7.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
- https://github.com/zoro-protocol/zoro-protocol/contracts/EIP20NonStandardInterface.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
Part of Zoro Protocol’s security record
Security firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us