Primex Finance

Resonance Security14 Oct 2024401 addresses on Ethereum, Polygon (POS) and Arbitrum

Audit · firm’s term: audit report

Resonance Security reviewed Primex Finance on 14 Oct 2024: 19 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Primex Finance’s security record

Report stored on IPFS. Content hash QmTYxEwVupgUuTGtiPHDYTp4EzkgttfTcrsqKuL4BPkHnd

Trustblock does not review code.

Findings19

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	0	0	19

LowGas Price Not Set For ArbitrumFixed

Issue identified by Primex:Gas price oracle was not set for Arbitrum, and defaultMaxGasPrice was used instead of it that caused incorrect min protocol fee and min position size calculations. We’ve added a wrapper contract on top of Arb gas price precompiles that returns gas price in the required format.

LowImpossible To Create Orders For Assets With Pull OraclesFixed

Issue identified by Primex:In createLimitOrder, there is a check that the expected position size is higher than minPositionSize. However this method dont include pullOracleData so it was impossible to create an order for assets with pull oracles.

LowImpossible To Execute Limit Orders Through PrimexUpkeepFixed

Issue identified by Primex:Executing a limit order through primexUpkeep is not possible as the method is not payable, and it cannot pay the Pyth pull oracle fee in the native token.

LowIncorrect Calculations For minFeeRestrictionsFixed

Issue identified by Primex:Method getL1BaseLengthForTradingOrderType returned the sum of lengths for position opening and closing for limit orders that caused incorrect calculations of minProtocolFee for these actions separately.

LowIncorrect Fee In Health Calculation After UpgradeFixed

Issue identified by Primex:The positions opened before the upgrade paid the protocol fee at the moment of opening, and the fee from them is not taken again upon closing, but this fee was taken into account in the health calculation. A check was added to avoid it.

LowIncorrect Token Amount Used In Protocol Fee Calculation For Batch ClosingFixed

Issue identified by Primex:An incorrect token amount was used in the protocol fee calculation for batch closing, tokenOut and amountIn were used instead of tokenOut and amoutOut.

LowLack Of Event Emission In TraderBalanceVaultFixed

Issue identified by Primex:The following functions do not emit relevant events after executing sensitive actions:withdrawFromincreaseLockedBalancetopUpAvailableBalance

LowLimit Orders Work Incorrectly Due To Fee StructureFixed

Issue identified by Primex:After the changes in fee structure, limit orders created before the upgrade worked incorrectly - the fee associated with them was locked after the order execution or editing, also the order became unexecutable and unclosable after editing.

LowminPositionSizeMultiplier MisinterpretationFixed

Issue identified by Primex:We renamed minPositionSizeMultiplier to minPositionSizeAddend because the old name didn’t correspond to its meaning, and irrelevant restrictions were removed.

LowMissing Estimation Of minProtocolFee For LiquidationFixed

Issue identified by Primex:Added a new method to Lens to calculate min protocol fee for liquidation.

Show 9 more

LowMissing extraParams In OpenPositionDataFixed

Issue identified by Primex:The OpenPositionData struct had no extraParams field in src/contracts/interfaces/IPrimexLens.sol

LowMissing protocolFeeCoefficient In minPositionSize CalculationFixed

Issue identified by Primex:The protocolFeeCoefficient was missed in minPositionSize calculation, but this coefficient is a part of min protocol fee, which defines the min position size.

LowMissing Reinitialization On SwapManager And BatchManager Due To UpgradeFixed

Issue identified by Primex:The initialize functions of SwapManager and BatchManager check the interfaces of the contracts they receive as parameters, including IPositionManagerV2 and IPriceOracleV2, which will be added with this upgrade. However, the initialize method was called before the upgrade of the PositionManager and PriceOracle contracts, causing the check to fail. To resolve this, the initialization was split into two steps, with the second step executed after the upgrade of these contracts.

LowMissing Revert Case For Uniswap v3 TWAP OracleFixed

Issue identified by Primex:Add revert to Uni v3 TWAP oracle for the case if the pool is unavailable.

LowOverly Restrictive Requirement Leads To Failed Token SwapsFixed

Issue identified by Primex:It was impossible to swap tokens through an arbitrary contract using DexAdapter.swapExactTokensForTokens as it required that the router had to be whitelisted. This restriction was removed.

LowParameter Name Mismatch In setPoolUpdateIntervalFixed

Issue identified by Primex:The setPoolUpdateInterval function in src/contracts/UniswapPriceFeed/UniswapPriceFeed.sol is designed to set poolUpdateInterval. However it will not work due to parameter name mismatch.

LowTransaction Fails Due To Price DifferenceFixed

Issue identified by Primex:The borrowed amount for margin limit orders was calculated during the order execution based on the oracle prices. At the same time, keepers calculate the swap route before the transaction execution, and if the amountIn used in the route and the amount calculated in tx differs, the transaction fails. To fix it, we allowed keepers to set the borrowed amount, but we also check that the leverage of the opened position can’t differ from the leverage of the order for more than leverageTolerance percentage.

LowUniform Health Check During LiquidationFixed

Issue identified by Primex:There is a difference in minProtocolFee calculation for single and batch position closing which leads to different health values and the liquidation price for the same position depending on the closing method.

LowUpdated Admin RolesFixed

Issue identified by Primex:Change admin roles for some methods.