Idle Finance

Off-Chain (Private)

Audited on 2021/05/31

No active critical issues

Summary

Executive Summary This report presents the results of our engagement with Idle Finance to review Idle Dynamic Tranches. The review was conducted by Nicholas Ward and Shayan Eskandari over the course of 20 person-days in June & July 2021. Scope The original review of 10 person-days began with commit hash d94ee7194e8cb17db13b16c338f3e780b62f5435 and incorporated commit hash 26d190539dec83c603edc9b5a903ce9b29b33a07, which provided a fix for an issue discovered independently by the development team. The complete list of files in scope for the initial review can be found in the Appendix.

Project

Idle Finance

Multi-Chain

Issues (9)

	Low	Medium	High	Critical	Total
Not fixed	6	3	-	-	9
Fixed	-	-	-	-	0
Total	6	3	0	0	9

Contracts (9)

#	File Name
1	IdleCDOTrancheRewards.sol
2	IdleCDOStorage.sol
3	GuardedLaunchUpgradable.sol
4	interfaces/IIdleCDOTrancheRewards.sol
5	interfaces/IERC20Detailed.sol
6	IdleCDO.sol
7	interfaces/IIdleCDOStrategy.sol
8	IdleCDOTrancheRewardsStorage.sol
9	IdleCDOTranche.sol

#	File Name
1	IdleCDOTrancheRewards.sol
2	IdleCDOStorage.sol
3	GuardedLaunchUpgradable.sol
4	interfaces/IIdleCDOTrancheRewards.sol
5	interfaces/IERC20Detailed.sol
6	IdleCDO.sol
7	interfaces/IIdleCDOStrategy.sol
8	IdleCDOTrancheRewardsStorage.sol
9	IdleCDOTranche.sol

Idle Finance

Summary

Issues (9)

IdleCDO._deposit() allows re-entrancy from hookable tokens.not_fixed/medium

IdleCDO.harvest() allows price manipulation in certain circumstancesnot_fixed/medium

IdleCDO.virtualPrice() and _updatePrices() yield different prices in a number of casesnot_fixed/medium

Clearly communicate admin capabilitiesnot_fixed/low

Documentation for formulas and price/reward calculationsnot_fixed/low

Contracts (9)