Zoro Protocol

QuantstampRepository at commit da78678

Audit

Quantstamp reviewed Zoro Protocol on 31 Jan 2024: 6 findings, 0 critical; 2 marked fixed, 3 acknowledged, 1 open.

No open critical findings
Open the reportOpen Zoro Protocol’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low132
LowExcessive Maximum Borrow RateFixed

The `borrowRateMaxMantissa` is used as an upper bound for the borrowing rate and initialized to `0.0005e16`, or 0.0005% per block. However, this value was determined based on the L1 block times of roughly 12 seconds. With interest now accruing every second rather than every block, this upper bound allows for a far higher borrowing rate.

LowPotential of Locked Funds in `Maximillion`Fixed

The `transfer()` call for sending native tokens to `msg.sender` in the `Maximillion.repayBehalfExplicit()` function has been re-written to `.call()` to be compatible with zkSync and also as a best practice. However, the return value of the `call()` function is not checked to be `true`. In case `msg.sender` reverts the transaction in its `fallback()` or the `receive()` function for any reason (e.g., developers forget to define a payable fallback function), the native tokens will be locked in the `Maximillion` contract permanently, as there is no other way to retrieve the funds.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (30)

  • https://github.com/zoro-protocol/zoro-protocol/contracts/ComptrollerInterface.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/ErrorReporter.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/DAIInterestRateModelV3.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/Reservoir.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/CEther.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/JumpRateModelV2.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/JumpRateModel.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/CTokenInterfaces.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/Governance/Comp.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/EIP20Interface.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/ExponentialNoError.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/Unitroller.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20Immutable.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20Delegate.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/Maximillion.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/BaseJumpRateModelV2.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/Lens/CompoundLens.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/Comptroller.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/CToken.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/CDaiDelegate.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/PriceOracle.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/CErc20Delegator.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/InterestRateModel.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/SimplePriceOracle.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/SafeMath.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/ComptrollerStorage.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/WhitePaperInterestRateModel.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/ComptrollerG7.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3
  • https://github.com/zoro-protocol/zoro-protocol/contracts/EIP20NonStandardInterface.sol at commit da78678d2ae33e2787a099f5de439c01c3a8e4d3

Part of Zoro Protocol’s security record

Zoro Protocol
Audits1 audit by 1 firmLast audit Jan 2024, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Zoro Protocol’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us