Compound Open Price Feed

Off-Chain (Private)

Audited on 2020/07/17

No active critical issues

Summary

The Compound team engaged us to audit a new view for their Open Price Feed, featuring an integration with Uniswap V2. The audited commit is d0a0d0301bff08457d9dfc5861080d3124d079cd, and the following files were included in scope: UniswapLib.sol UniswapConfig.sol UniswapAnchoredView.sol High-level... (defined by the deployer of the view), greatly limiting the reporter’s powers to manipulate the oracle. It must be noted that, as a difference from our previous audit of the Open Price Feed, in this case the reporter is represented by a single account, and the price is not calculated as a median...

Project

Compound

Multi-Chain

Issues (17)

	Low	Medium	High	Critical	Total
Not fixed	13	4	-	-	17
Fixed	-	-	-	-	0
Total	13	4	0	0	17

Contracts (3)

#	File Name
1	contracts/Uniswap/UniswapAnchoredView.sol
2	contracts/Uniswap/UniswapConfig.sol
3	contracts/Uniswap/UniswapLib.sol

#	File Name
1	contracts/Uniswap/UniswapAnchoredView.sol
2	contracts/Uniswap/UniswapConfig.sol
3	contracts/Uniswap/UniswapLib.sol

Compound Open Price Feed

Summary

Issues (17)

[M01] Convoluted price update mechanism once reporter is invalidatednot_fixed/medium

[M02] Inconsistent behavior when anchor price is zeronot_fixed/medium

[M03] Unexpected behavior when retrieving the underlying price of a cTokennot_fixed/medium

[M04] Incorrect event emissionnot_fixed/medium

[L01] Initial configured markets might not be Uniswap V2 pairsnot_fixed/low

Contracts (3)