Voltz Protocol

QuantstampFiles named in the report

Audit

Quantstamp reviewed Voltz Protocol on 25 Mar 2022: 8 findings, 0 critical; 4 marked fixed, 4 acknowledged.

No open critical findings
Open the reportOpen Voltz Protocol’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium010
Low034
MediumIncorrect Trigger Condition for `checkPositionMarginAboveRequirement()`Acknowledged

On `L409` in `MarginEngine.sol`, the function `checkPositionMarginAboveRequirement()` is invoked when the caller is trying to add some liquidity (i.e., when `params.liquidityDelta > 0`) to their `position` instead of when the liquidity gets removed (i.e., when `params.liquidityDelta < 0`). Failing to correctly check the required margin could lead to un-recoverable fund loss on the platform.

LowAnyone Can Add Margin to Any PositionAcknowledged

On `L281` of `MarginEngine.sol`, the code allows anyone to add margin to any position. There is a possibility that this could be utilized by an attacker to manipulate the system in order to conduct a more complex attack.

LowPrivileged Roles and OwnershipAcknowledged

Smart contracts will often have `owner` variables to designate the person with special privileges to make modifications to the smart contract. Specifically, there are some actions that could have important consequences for end-users: 1. The owner of `contracts/Factory.sol` can call owner-only functions in `contracts/MarginEngine.sol` and manipulate all the parameters at any time at will. 1. The owner of `contracts/Factory.sol` can call owner-only functions in `contracts/VAMM.sol` and manipulate all the parameters at any time at will. 1. The owner of `contracts/Factory.sol` can call owner-only functions in `contracts/MarginEngine.sol` and change the external contracts used by the `MarginEngine` at any time at will. 1. The owner of `rate_oracles/BaseRateOracle.sol` can call owner-only functions.

LowUpdating a Position Without Making an Actual Token TransferAcknowledged

The functions `mint()` and `burn()` can be used to modify position's margin without calling `updatePositionMargin()` that transfers in or out the required tokens. This could be used by attackers to potentially manipulate the internal state of the contract which may lead to unexpected results.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (67)

  • contracts/rate_oracles/AaveRateOracle.sol
  • contracts/test/TestMarginEngine.sol
  • contracts/test/MockAaveLendingPool.sol
  • contracts/core_libraries/FixedAndVariableMath.sol
  • contracts/core_libraries/Position.sol
  • contracts/utils/FixedPoint96.sol
  • contracts/test/ERC20Mock.sol
  • contracts/test/LiquidityMathTest.sol
  • contracts/test/TimeTest.sol
  • contracts/test/PositionTest.sol
  • contracts/utils/TickMath.sol
  • contracts/test/Actor.sol
  • contracts/test/ERC20.sol
  • contracts/periphery/Periphery.sol
  • contracts/utils/SqrtPriceMath.sol
  • contracts/core_libraries/Tick.sol
  • contracts/test/TestRateOracle.sol
  • contracts/utils/LiquidityMath.sol
  • contracts/interfaces/IFactory.sol
  • contracts/interfaces/IMarginEngine.sol
  • contracts/interfaces/rate_oracles/IAaveRateOracle.sol
  • contracts/utils/FullMath.sol
  • contracts/rate_oracles/BaseRateOracle.sol
  • contracts/utils/UnsafeMath.sol
  • contracts/test/E2ESetup.sol
  • contracts/interfaces/rate_oracles/IRateOracle.sol
  • contracts/interfaces/fcms/IAaveFCM.sol
  • contracts/core_libraries/SafeTransferLib.sol
  • contracts/utils/Errors.sol
  • contracts/utils/CustomErrors.sol
  • contracts/storage/VAMMStorage.sol
  • contracts/VAMM.sol
  • contracts/storage/MarginEngineStorage.sol
  • contracts/rate_oracles/OracleBuffer.sol
  • contracts/storage/FCMStorage.sol
  • contracts/test/TestAaveFCM.sol
  • contracts/test/TickBitmapTest.sol
  • contracts/aave/AaveDataTypes.sol
  • contracts/interfaces/aave/IAToken.sol
  • contracts/interfaces/IVAMM.sol
  • contracts/interfaces/IPositionStructs.sol
  • contracts/periphery/peripheral_libraries/LiquidityAmounts.sol
  • contracts/test/TestVAMM.sol
  • contracts/utils/SafeCastUni.sol
  • contracts/interfaces/aave/IAaveV2LendingPool.sol
  • contracts/test/MarginCalculatorTest.sol
  • contracts/test/TickTest.sol
  • contracts/test/FixedAndVariableMathTest.sol
  • contracts/test/SwapMathTest.sol
  • contracts/utils/FixedPoint128.sol
  • contracts/utils/Printer.sol
  • contracts/core_libraries/Time.sol
  • contracts/AaveFCM.sol
  • contracts/test/MockAToken.sol
  • contracts/utils/WadRayMath.sol
  • contracts/core_libraries/TickBitmap.sol
  • contracts/Factory.sol
  • contracts/core_libraries/SwapMath.sol
  • contracts/MarginEngine.sol
  • contracts/interfaces/fcms/IFCM.sol
  • contracts/utils/BitMath.sol
  • contracts/core_libraries/TraderWithYieldBearingAssets.sol
  • contracts/interfaces/IPeriphery.sol
  • contracts/interfaces/IERC20Minimal.sol
  • contracts/test/SqrtPriceMathTest.sol
  • contracts/test/TickMathTest.sol
  • contracts/core_libraries/MarginCalculator.sol

Part of Voltz Protocol’s security record

Voltz Protocol
Audits1 audit by 1 firmLast audit Mar 2022, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Voltz Protocol’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us