Primex Finance

Resonance Security14 Oct 2024401 addresses on Ethereum, Polygon (POS) and Arbitrum

Audit

Resonance Security reviewed Primex Finance on 14 Oct 2024: 7 findings, 0 critical; 4 marked fixed, 3 open.

No open critical findings

Open the report Open Primex Finance’s security record

Report stored on IPFS. Content hash QmbtZQiM2MkamQJtLufxuXbArCDcx7sFaoBMbTWg6nUmJx

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	2
Medium	1	0
Low	2	2

HighInvalid Asset Price Due To Incomplete Price MappingsFixed

The PriceOracle contract is responsible for dictating the prices for given assets. The prices could be fetched using multiple of sources - Uniswap, Pyth and Chainlink to be precise. However, the Pyth and Chainlink sources support only prices denominated in USD. The PriceOracle contract keeps the prices in a mapping that is indexed with the asset price and returns that asset's price in USD. Hence, if the requested price is for a pair that does not include USD (for instance BTC/ETH) and Pyth/Chainlink is used as a price source, then the _getExchangeRate() function would actually return the price denominated in USD which will lead to invalid calculations.

HighMissing Return Value On _swapExactTokensForTokens() Leads To Incorrect CalculationsFixed

The functions performPathsSwap() and swapExactTokensForTokens() make use of the internal function _swapExactTokensForTokens() and expect a uint256[3]value to be returned. Further calculations are made with this returned value. However, for the DexType.Paraswap, no value is returned, both leading to incorrect calculations of values presented to the caller of the functions.

LowRedundant Code On _withdrawBucketLiquidityFromAave()Fixed

The function _withdrawBucketLiquidityFromAave() is duplicated on both Bucket and BucketExtension contracts. This fact makes the code more complex and less readable, while also wasting unnecessarily more bytecode on the blockchain.

LowUnnecessary Usage Of int256 On minPositionSizeMultiplierFixed

The contract KeeperRewardDistributorStorageV2 implements the state variable minPositionSizeMultiplier as an int256. The usage of this state variable throughout the code assumes that it will always contain an unsigned integer. Therefore, various checks may be removed to optimize gas.