UnibotX security record

At several locations, it is possible to set or update important state variables with dedicated functions. However, a check is not always made to make sure that the new value is correct, meaning between a minimum and a maximum value to prevent any disruption of the core functions of the protocol. In addition, an event is not always emitted. For example: - `LendingPoolV3.setPerformanceFee()` should validate `_performanceFee` to be lower than BPS. - `DiamondFactoryController.constructor()` does not validate any input. - `DiamondFactoryController.setLiquidationBonus()` does not limit the liquidation bonus. - `DiamondFactoryController.setMaxPositionNumber()` does not limit the `_maxPositionNumber`. - `DiamondFactoryController.setPerformanceFee()` does not limit the `_performanceFee`. - `DiamondFactoryController.setBalanceVaultAddress()` does not validate the `_balanceVault` address. - `DiamondFactoryController.setHelperAddress()` does not validate the `_helper` address. - `DiamondFactoryController.setFeeRecipient()` does not validate the `_feeRecipient`. - `DiamondFactoryV3.init()` does not validate any of the inputs. - `DiamondFactoryV3.setLiquidationThreshold()` does not set boundaries to the new liquidation threshold value. - `DiamondFactoryV3.setBorrowRatioMax()` does not limit the max borrow rate in case of invalid input which represent a high risk. - `DiamondFactoryV3.setReserveRatioMax()` does not validate if the reserve ratio is less than `BPS`. - `DiamondFactoryV3.setStopLossFee()` does not limit the maximum fee amount. - `DiamondFactoryV3.setController()` does not validate the controller address. - `DiamondFactoryV3.setSlippage()` does not limit the slippage value. - `DiamondFactoryHelper.getPositionTokenAmount()` does not validate if the pool address and the pool want token match. - `DiamondFactoryController.addContractWhiteList()` has to validate that the input address is a contract address. - `InterestModel.setNewInterest()` does not validate `_newThreshold`, `_newSlope1` and `_newSlope2`. The severity is assessed as [Medium]: - the impact is High. A wrong value could impact the core functions of the protocol, but it could generally be updated. However, logging such updates would allow the detection of any issue through off-chain monitoring. - the likelihood is Low as these operations can only be initiated by the contract owner, and we can expect that double-checks are performed.

For three couples of variables, the fact that the max limit is greater than the min limit (and vice versa) is not checked in the functions `init()`, `_checkOpenPositionParams()`, and in the underlying setter functions. It is also the case in the function `update()` of the library `Positions`. The couples are: - `stopLossLowerPriceTick` and `stopLossUpperPriceTick`; - `openPositionMinimumAmount` and `openPositionMaximumAmount`; - `borrowRatioMin` and `borrowRatioMax`; Such inconsistencies could block the core mechanisms of the protocol.