Curve Finance (diff)

Quantstamp5 Oct 2020Files named in the report

Quantstamp reviewed Curve.fi (Curve Finance (diff)) on 5 Oct 2020: 4 findings, 0 critical; 1 marked fixed, 3 acknowledged.

No open critical findings

Open the report Open Curve.fi’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings4

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	1
Low	3	0

LowBlock Timestamp ManipulationAcknowledged

Projects may rely on block timestamps for various purposes. However, it's important to realize that miners individually set the timestamp of a block, and attackers may be able to manipulate timestamps for their own purposes. If a smart contract relies on a timestamp, it must take this into account. In `_A()` of `SwapTemplateMeta.vy`, the returned value is dependent on `block.timestamp`. This implementation entails some risk that `Amplification coefficient` is manipulated by a malicious agent. For example, miners who happen to want to swap some tokens could interfere the development of `Amplification coefficient` as a means to get a trading advantage.

LowImplicit Assumption that Only One Base Pool Is Allowed per MetapoolAcknowledged

The code implicitly allows only one base pool per metapool due to the implementation of `__init__()` and `MAX_COINS = N_COINS - 1`. It would not be possible to set up a metapool with two base pools with non-overlapping assets [GUSD, [3Pool], [sBTC]].

LowInsufficient Input ValidationAcknowledged

1. `_A` , `_fee` and `_admin_fee` in __init__() of `SwapTemplateMeta.vy` are not validated. Values bigger than `MAX_A `, `MAX_ADMIN_FEE` or `MAX_FEE` can be set here. 2. `_owner`, ` _pool_token`, `_base_pool` in `__init__()` of `SwapTemplateMeta.vy` are not validated. Providing incorrect values may result in a later discovery that the smart contract is not working as intended. 3. `_token` in `__init__()` of `DepositTemplateMeta.vy` is not validated. Providing incorrect values may result in a later discovery that the smart contract is not working as intended.