Zoro Protocol

Quantstamp31 Jan 2024Repository at commit da78678

Audit

Quantstamp reviewed Zoro Protocol on 31 Jan 2024: 6 findings, 0 critical; 2 marked fixed, 3 acknowledged, 1 open.

No open critical findings

Open the report Open Zoro Protocol’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	1	3	2

Low`block.timestamp` May Not Be FutureproofAcknowledged

The Zoro Protocol uses `block.timestamp` instead of `block.number`. However, there is a check in the `Comptroller._initializeMarket()` function which casts the value returned by `getBlockNumber()` as `uint32` and reverts if the value exceeds `32` bits. The timestamp currently takes `31` bits, which means that the protocol may experience denial of service in the future when the timestamp exceeds a value that can be represented by a number less than `32` bits.

LowIncorrect Return Value of `getCompAddress()`Acknowledged

The `Comptroller.getCompAddress()` function returns the hard-coded `COMP` token address deployed on the Ethereum mainnet instead of the governance token of the protocol.

LowPrivileged Roles and OwnershipAcknowledged

The protocol owner and admin serve privileged roles and can control the configurations of the contract or execute specific functions. Therefore, users are exposed to the risk of being attacked if the privileged roles are compromised. - The `owner` of `BaseJumpRateModelV2` or `DAIInterestRateModelV3` can: - Update the parameters of the interest rate model - The `admin` of `CToken` can: - Set the pending admin of the contract - Set the `Comptroller` and interest rate model addresses - Set the reserve and reduce factors - Initialize the contract after creation - The `admin` of `CErc20` can: - Sweep tokens other than the underlying tokens from the contract - Delegate the votes of the `COMP`-like underlying tokens to an arbitrary address - The `admin` of `CErc20Delegator` can: - Set the implementation contract of this proxy contract - The `admin` of `Unitroller` can: - Set the pending admin of the contract - Set the pending implementation of this proxy contract - The `admin` of `Comptroller` can: - Set the price oracle, borrow cap guardian, and pause guardian addresses - Set the close factor, collateral factor, and borrow cap of a market - Set the liquidation incentive of the protocol - List new markets - Pause the mint and borrow functionality of a market - Pause the transfer of seize operations of the protocol - Assign the implementation contract of a `Unitroller` proxy - Calls `fixBadAccruals()` to adjust the users' accrued `COMP` token - This function was a fix introduced in Compound for Proposal 65 but should be irrelevant to the Zoro protocol

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (30)

https://github.com/zoro-protocol/zoro-protocol/contracts/ComptrollerInterface.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/ErrorReporter.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/DAIInterestRateModelV3.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/Reservoir.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/CEther.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/JumpRateModelV2.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/JumpRateModel.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/CTokenInterfaces.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/Governance/Comp.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/EIP20Interface.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/ExponentialNoError.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/Unitroller.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20Immutable.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20Delegate.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/Maximillion.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/BaseJumpRateModelV2.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/Lens/CompoundLens.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/Comptroller.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/CToken.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/CDaiDelegate.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/PriceOracle.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20Delegator.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/InterestRateModel.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/SimplePriceOracle.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/SafeMath.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/ComptrollerStorage.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/WhitePaperInterestRateModel.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/ComptrollerG7.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
https://github.com/zoro-protocol/zoro-protocol/contracts/EIP20NonStandardInterface.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3

Part of Zoro Protocol’s security record

Zoro Protocol

Audits1 audit by 1 firmLast audit Jan 2024, by Quantstamp.

Critical findingsNo open critical findingsIn 1 report.

Open Zoro Protocol’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us