Derify protocol Ⅱ

CertiK16 Sep 2022Files named in the report

CertiK reviewed Derify protocol (Derify protocol Ⅱ) on 16 Sep 2022: 22 findings, 0 critical; 11 marked fixed, 8 acknowledged, 3 open.

No open critical findings

Open the report Open Derify protocol’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings22

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	8	0
Medium	1	0	1
Low	2	0	10

MediumRepeat modifier `nonReentrant` on function `withdFixed

The above-mentioned function has two modifiers `nonRentrant`.

LowDecimals in the contract `DerifyBroker`Fixed

The value of the public constant CONTRACT_DECIMAL is 10e8 in the DerifyBroker contract, hence all the accounts' decimals should be 8. While USD, DRF, and EDRF are with decimals 18. So the protocol has to interact with USD contract and handle the different decimals.

LowDesign on liquidationFixed

If the account is liquidated, his/her account balance will be cleared.

LowestimateGasFee not based on operatedSizeFixed

The amount of the fee is not relevant to the actual `operatedSize`. As long as the position is processed, there will be a flat fee.

LowEvents can be mergedFixed

If the updates of gasFeePool are always together with the updates of gasBalance, then the two events can be merged for better simplicity.

LowFunction `transferFrom()` not recommendedFixed

The function `transferFrom()` in an ERC20 contract is used for receiving the user's payment to the contract. When the contract needs to transfer money out, it's better to use the function `transfer()` because there is the potential that the target token does not support transferring from users selves.

LowInformation about the position change feeFixed

The position change fee is calculated with kRatio, gRatio, and roRatio. The three ratios are set by the owner and it's hard to understand their meanings.

LowMissing Emit EventsFixed

The function that affects the status of sensitive variables should be able to emit events as notifications to users.

LowTypoFixed

The function name should be `cancelAllOrderedPositions` rather than `cancleAllOrderedPositions`.

LowUnchecked Value of ERC-20 `transfer()`/`transferFFixed

The linked `transfer()`/`transferFrom()` invocations do not check the return value of the function call which should yield a `true` result in case of a proper ERC-20 implementation.

Show 1 more

LowUnknown implementation of `communityVestingVault`Fixed

The contract is serving as the underlying entity to interact with `communityVestingVault`, which is an external dependency in this audit. The scope of the audit treats 3rd party entities as black boxes and assumes their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. Additionally, the value `amountVested` is calculated by the function `communityVestingVault.calculateGrantClaim()` and is added to the variable `drfRewardPool`. It's recommended to return the actual value in the function `claimVestedTokens` in case the accounts and funds are not reconciled.