Zoro Protocol

Off-Chain (Public)

Audited on 2024/03/25

No active critical issues

Summary

Zoro Protocol is a decentralized lending protocol, a fork of Compound designed to run on zkSync Era. The changes included the removal of the GovernorAlpha and GovernorBravo contracts, modifying `transfer()` calls to a safer `call()` pattern, and calculating elapsed time with `block.timestamp` rather than `block.number`. The Zoro Protocol uses the ORO token rather than the COMP token for governance. During the audit, we found issues pertaining to unchecked return values for transfers (ZORO-1), borrow rates reflecting old block times (ZORO-2), and privileged roles (ZORO-3). We also list some of the known issues with Compound (ZORO-6). We recommend addressing all issues before deployment. **Fix-Review Update:** All of the issues were addressed or acknowledged. Note that ZORO-6 was addressed by changing the deployment scripts.

Project

Zoro Protocol

Ethereum

Issues (6)

	Low	Medium	High	Critical	Total
Not fixed	4	-	-	-	4
Fixed	2	-	-	-	2
Total	6	0	0	0	6

Contracts (30)

#	Github Repository	Commit Hash	File	Url
21	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/ExponentialNoError.sol	Check on Github
22	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/EIP20Interface.sol	Check on Github
23	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/Governance/Comp.sol	Check on Github
24	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/CTokenInterfaces.sol	Check on Github
25	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/JumpRateModel.sol	Check on Github
26	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/JumpRateModelV2.sol	Check on Github
27	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/CEther.sol	Check on Github
28	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/Reservoir.sol	Check on Github
29	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/DAIInterestRateModelV3.sol	Check on Github
30	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/ErrorReporter.sol	Check on Github

#	Github Repository	Commit Hash	File	Url
21	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/ExponentialNoError.sol	Check on Github
22	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/EIP20Interface.sol	Check on Github
23	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/Governance/Comp.sol	Check on Github
24	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/CTokenInterfaces.sol	Check on Github
25	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/JumpRateModel.sol	Check on Github
26	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/JumpRateModelV2.sol	Check on Github
27	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/CEther.sol	Check on Github
28	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/Reservoir.sol	Check on Github
29	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/DAIInterestRateModelV3.sol	Check on Github
30	zoro-protocol/zoro-protocol	da78678d2ae33e2787a099f5de439c01c3a8e4d3	contracts/ErrorReporter.sol	Check on Github

Zoro Protocol

Summary

Issues (6)

`block.timestamp` May Not Be Futureproofnot_fixed/low

Incorrect Return Value of `getCompAddress()`not_fixed/low

Known Issues in the Compound V2 Protocolnot_fixed/low

Privileged Roles and Ownershipnot_fixed/low

Contracts (30)