Neutra Finance security record

The contract `BatchRouer` will eventually call the functions of the Strategy Vault are not implemented, which will impact the intended behavior of the whole contract. - function executeBatchPositions()->IRouter(router).executePositionsBeforeDealGlp()->IStrategyVault(strategyVault).executeIncreasePositions() - function confirmAndDealGlp()->IRouter(router).confirmAndBuy()->_vault.buyNeuGlp() - function confirmAndDealGlp()->IRouter(router).confirmAndSell()->_vault.sellNeuGlp() ```solidity /// deprecated /// @dev withdraw init function /// execute wbtc, weth decrease positions function executeDecreasePositions(bytes[] calldata _params) external payable onlyRouter { } /// deprecated /// @dev should be called only if positions execution had been failed function retryPositions(bytes4[] calldata _selectors, bytes[] calldata _params) external payable onlyKeepersAndAbove { } /// deprecated function buyNeuGlp(uint256 _amountIn) external onlyRouter returns (uint256) { } /// deprecated function sellNeuGlp(uint256 _glpAmount, address _recipient) external onlyRouter returns (uint256) { } ``` Due to these unimplemented functions, users are unable to successfully buy `glp` and stake it to get rewards.

There is no guarantee that batch is not under execution.

Neutra Finance will divide the assets entrusted by users into three parts, which will be used respectively for (1) purchasing GLP, (2) shorting WBTC, and (3) shorting WETH. Users will receive nGlp tokens as share certificates, with the quantity being the sum of the nGlp generated from the three parts mentioned above. The nGlp will be automatically staked, and users will ultimately receive an equal number of snGlp tokens. When users redeem their assets from Neutra Finance using snGlp, the incoming snGlp tokens should also be divided into three parts, which will be used respectively for (1) selling GLP, (2) closing WBTC positions, and (3) closing WETH positions. However, the current logic of the `instantWithdraw()` function in the RouterV2 contract does not split the incoming snGlp tokens, and the quantity of snGlp tokens used for selling GLP, closing WBTC positions, and closing WETH positions is equal to the quantity of snGlp tokens passed in by the user. This may lead to the redemption operation being rolled back due to insufficient nGlp tokens, causing users to be unable to retrieve their entrusted assets, or it may result in users taking out more assets than they entrusted, as the RouterV2 contract has sufficient nGlp tokens.

The function `executeBatchPositions` will eventually call the function `executeIncreasePositions` of the strategy vault to increase WBTC/WETH position. However, the function `executeIncreasePositions` seems deprecated and is not implemented. So the execution fee should not be charged.