Rari Capital (On-chain Governance)
Quantstamp reviewed Rari Capital (Rari Capital (On-chain Governance)) on 2 Jul 2021: 8 findings, 0 critical; 4 marked fixed, 3 acknowledged, 1 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings8
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 1 | 3 | 2 |
Medium`ChainlinkPriceOracleV2._price` Does Not Consult Decimal ValuesFixed
The function `_price` queries various Chainlink oracles, however, the decimal value associated with each price feed is not considered. This may lead to over/undervaluing the price of the `underlying` token being considered.
Medium`FixedEurPriceOracle` May Return Stale PricesFixed
The function `_price` consults several oracles without ensuring that the returned data is recent. This may lead to stale pricing results and potential arbitrage.
LowIncorrect `getUnderlyingPrice` ComputationFixed
The function `getUnderlyingPrice` appears to be copied from `FixedEthPriceOracle.sol`, and therefore relates the token price to ETH, not EUR.
LowUnintended Code Removal In `Comptroller.mintAllowed`Fixed
The following snippet was removed, however, it seems this check is necessary based on the function name. ``` // Make sure minter is whitelisted if (enforceWhitelist && !whitelist[minter]) { return uint(Error.SUPPLIER_NOT_WHITELISTED); } ```
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (66)
- contracts/CErc20Delegator.sol
- contracts/Governance/GovernorAlpha.sol
- contracts/CEtherDelegate.sol
- AggregatorV3Interface.sol
- IUniswapV2Router02.sol
- contracts/CErc20.sol
- CToken.sol
- contracts/ErrorReporter.sol
- contracts/CarefulMath.sol
- ICurveLiquidityGaugeV2.sol
- contracts/CErc20Delegate.sol
- contracts/CEtherDelegator.sol
- contracts/Lens/CompoundLens.sol
- contracts/Governance/Comp.sol
- ICurveRegistry.sol
- IUniswapV2Router01.sol
- contracts/CEtherImmutable.sol
- contracts/Unitroller.sol
- RariGovernanceToken.sol
- UniswapTwapPriceOracleRoot.sol
- contracts/CTokenInterfaces.sol
- Comptroller.sol
- IUniswapV2Pair.sol
- contracts/CDaiDelegate.sol
- contracts/Timelock.sol
- Unitroller.sol
- contracts/ComptrollerInterface.sol
- IVault.sol
- IVaultV2.sol
- contracts/SafeMath.sol
- contracts/CErc20Immutable.sol
- ChainlinkPriceOracle.sol
- contracts/ComptrollerG1.sol
- UniswapV2Library.sol
- contracts/Comptroller.sol
- CurveLpTokenPriceOracle.sol
- IUniswapV2Factory.sol
- FixedEthPriceOracle.sol
- contracts/InterestRateModel.sol
- contracts/CEther.sol
- ICurvePool.sol
- ChainlinkPriceOracleV2.sol
- BasePriceOracle.sol
- FixedEurPriceOracle.sol
- contracts/ComptrollerStorage.sol
- contracts/JumpRateModel.sol
- IUniswapV2Callee.sol
- contracts/Exponential.sol
- contracts/DAIInterestRateModelV2.sol
- CurveLiquidityGaugeV2PriceOracle.sol
- contracts/SimplePriceOracle.sol
- contracts/EIP20Interface.sol
- contracts/CToken.sol
- YVaultV2PriceOracle.sol
- contracts/WhitePaperInterestRateModel.sol
- UniswapTwapPriceOracle.sol
- IWETH.sol
- UniswapV3TwapPriceOracle.sol
- CErc20.sol
- CEther.sol
- contracts/IFuseFeeDistributor.sol
- contracts/EIP20NonStandardInterface.sol
- PriceOracle.sol
- contracts/PriceOracle.sol
- contracts/Maximillion.sol
- MasterPriceOracle.sol
Part of Rari Capital’s security record
Security firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us