YFX - security record

In the contract **FundingLogic**, the role **controller** has authority over the following functions: - function updateMaxFundingRate() - function updateMarketPriceFeed() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Update max funding rate to any value and disrupt the funding rate calculation mechanism. - Update market price feed to a malicious contract and disrupt the funding rate calculation mechanism. --- In the contract **InterestLogic**, the role **controller** has authority over the following function: - function updateRatePerHour() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Update max hourly interest rate of any pool, and disrupt the borrow rate calculation mechanism. --- In the contract **InviteManager**, the role **controller** has authority over the following functions: - function setIsUTPPaused() - function setIsURPPaused() - function setUpgradeToken() - function setTradeToken() - function setInviteToken() - function setTier() - function setReferrerTier() - function setCodeOwnerBySystem() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Pause/Unpause the `UTP` mode, which controls whether or not to send `User Trading Proof Token` to traders. - Pause/Unpause the `URP` mode, which controls whether or not to send `User Referral Proof Token` to inviters. - Update the `Update Token` to any new token. - Update the `User Trading Proof Token` to any new token. - Update the `User Referral Proof Token` to any new token. - Update the fee rebate and fee discount of an invitation level. - Update the invitation level of any inviter. A higher invitation level means a higher fee rebate for the inviter and a higher fee discount for the invitee. - Update the invitation code of an user. In the contract **InviteManager**, the role **router** has authority over the following function: - function setTraderReferralCode() Under normal circumstances, the **router** should be the `Router` contract and this would not be a centralization issue. However, if the router is set up maliciously in `Manager` contract, this could lead to hackers being able to tamper with other trader's invitation relationships at will and profit from them. In the contract **InviteManager**, the role **market** has authority over the following functions: - function updateTradeValue() Under normal circumstances, the **market** should be the `Market` contract and this would not be a centralization issue. However, if the market is set up maliciously in `Manager` contract, this could lead to hackers being able to mint `TradeToken` and `InviteToken` at will and profit from them. --- In the contract **Manager**, the role **controller** has authority over the following functions: - function pause() - function unpause() - function modifyExecutor() - function modifyTreasurer() - function modifyOrderNumLimit() - function modifyRouter() - function modifySigner() - function modifyController() - function modifyRiskFunding() - function modifyInterestStatus() - function modifyFundingStatus() - function modifyVault() - function modifyExecuteOrderFee() - function modifyInviteManager() - function modifyMarketPriceFeed() - function modifyMarketLogic() - function modifyCancelElapse() - function modifyCommunityExecuteOrderDelay() - function modifyTriggerOrderDuration() - function createPair() - function setMarketConfig() - function modifyMarketCreateOrderPaused() - function modifyMarketTPSLPricePaused() - function modifyMarketCreateTriggerOrderPaused() - function modifyMarketUpdateMarginPaused() - function modifyExecutorRouter() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Pause/Unpause the `YFX` protocol. - Update the executors. - Update the treasurers who are entitled to use the risk funds at will. If set up as a treasurer, the hacker can drain the risk funds. - Update the maximum number of orders. - Update the `Router` contract, which is a portal of all the user operations. - Update the signers who are entitled to provide the off-chain price and execute orders. If set up as a signer, the hacker can manipulate the price and get profits. - Update the controller who is the super admin of the `YFX` protocol. If set up as the controller, the hacker can do any thing mentioned in this section. - Update the `RiskFunding` contract, which is used to hold the risk funds. If set up as the risk funding contract, the hacker can receive the risk funds when liquidation happens. - Activate/Deactivate the interests module. - Activate/Deactivate the funding module. - Update the `Vault` contract, which is used to hold the market/pool assets. If set up as the vault contract, the ha

In the contract **FundingLogic**, the role **controller** has authority over the following functions: - function updateMaxFundingRate() - function updateMarketPriceFeed() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Update max funding rate to any value and disrupt the funding rate calculation mechanism. - Update market price feed to a malicious contract and disrupt the funding rate calculation mechanism. --- In the contract **InterestLogic**, the role **controller** has authority over the following functions: - function updateRatePerHour() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Update max hourly interest rate of any pool, and disrupt the borrow rate calculation mechanism. --- In the contract **InviteManager**, the role **controller** has authority over the following functions: - function setIsUTPPaused() - function setIsURPPaused() - function setTradeToken() - function setInviteToken() - function setTier() - function setReferrerTier() - function setCodeOwnerBySystem() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Pause/Unpause the `UTP` mode, which controls whether or not to send `User Trading Proof Token` to traders. - Pause/Unpause the `URP` mode, which controls whether or not to send `User Referral Proof Token` to inviters. - Update the `User Trading Proof Token` to any new token. - Update the `User Referral Proof Token` to any new token. - Update the fee rebate and fee discount of an invitation level. - Update the invitation level of any inviter. A higher invitation level means a higher fee rebate for the inviter and a higher fee discount for the invitee. - Update the invitation code of an user. In the contract **InviteManager**, the role **router** has authority over the following functions: - function setTraderReferralCode() Under normal circumstances, the **router** should be the `Router` contract and this would not be a centralization issue. However, if the router is set up maliciously in `Manager` contract, this could lead to hackers being able to tamper with other trader's invitation relationships at will and profit from them. In the contract **InviteManager**, the role **market** has authority over the following functions: - function updateTradeValue() Under normal circumstances, the **market** should be the `Market` contract and this would not be a centralization issue. However, if the market is set up maliciously in `Manager` contract, this could lead to hackers being able to mint `TradeToken` and `InviteToken` at will and profit from them. --- In the contract **Manager**, the role **controller** has authority over the following functions: - function pause() - function unpause() - function modifyLiquidator() - function modifyTreasurer() - function modifyOrderNumLimit() - function modifyRouter() - function addSigner() - function removeSigner() - function modifyController() - function modifyRiskFunding() - function modifyInterestStatus() - function modifyFundingStatus() - function modifyVault() - function modifyExecuteOrderFee() - function modifyInviteManager() - function modifyCancelElapse() - function modifyCommunityExecuteOrderDelay() - function modifyTriggerOrderDuration() - function createPair() - function setMarketConfig() - function modifyMarketCreateOrderPaused() - function modifyMarketTPSLPricePaused() - function modifyMarketCreateTriggerOrderPaused() - function modifyMarketUpdateMarginPaused() Any compromise to the **controller** account may allow a hacker to take advantage of this authority and do the following(but not limited to). - Pause/Unpause the `YFX` protocol. - Update the liquidators who are entitled to liquidate. - Update the treasurers who are entitled to use the risk funds at will. If set up as a treasurer, the hacker can drain the risk funds. - Update the maximum number of orders. - Update the `Router` contract, which is a portal of all the user operations. - Add/Remove the signers who are entitled to provide the off-chain price and execute orders. If set up as a signer, the hacker can manipulate the price and get profits. - Update the controller who is the super admin of the `YFX` protocol. If set up as the controller, the hacker can do any thing mentioned in this section. - Update the `RiskFunding` contract, which is used to hold the risk funds. If set up as the risk funding contract, the hacker can receive the risk funds when liquidation happens. - Activate/Deactivate the interests module. - Activate/Deactivate the funding module. - Update the `Vault` contract, which is used to hold the market/pool assets. If set up as the vault contract, the hacker can steal the entire assets and ruin the `YFX` protocol. - Update the execute order fee, which is the gas f

In the contract **TradeToken**, the role **inviteManager** has authority over the following function: - function mint() Under normal circumstances, the **inviteManager** should be the `InviteManager` contract and this would not be a centralization issue. However, if the `inviteManager` is set up maliciously in `Manager` contract, this could lead to hackers being able to mint `TradeToken` at will and profit from it.

The valuation of assets in the `YFX` market depends on two sources: firstly, the price of `ChainLink`, and secondly, the off-chain price. According to the logical framework of the `FastPriceFeed` and `MarketPriceFeed` contracts, it is understood that the final valuation of market assets is determined by selecting the maximum or minimum value between the `ChainLink` price and the off-chain price, based on the given scenario. The `ChainLink` price is obtained by accessing the `ChainLink` Price Feed contract, while the off-chain price is submitted as a function parameter value during the execution of orders by the `PriceProvider` role and during the liquidation process by the `Liquidator` role in the `FastPriceFeed` contract. In this situation, any compromise to the `Controller & PriceProvider`/ `Controller & Liquidator` accounts may provide an opportunity for a hacker to exploit this authority and engage in the following activities: - Invoking the `batchExecuteOrder()` function to execute opening/closing orders and submit forged market asset prices, thereby influencing the actual trade prices. - Invoking the `setPrices()` function will affect the trade prices. - Invoking the `liquidate()` function to initiate the liquidation process and submitting forged market asset prices, thereby affecting the liquidation price.

The `Vault` contracts stores all the deposits including liquidity pool assets and user position margins. Any compromise to the **controller** account may allow a hacker to take advantage of this authority and simply take all the deposits.

There are no upper boundaries for linked functions which is used to set max hourly interests ratio, price provider fee and `executeLiquidateFee`. Those three functions can only be called by the role controller. Any compromise to the controller account may allow the hacker to take advantage of this authority and set the total fee up to any arbitrary amount.

The `increaseMargin` function have a vulnerability that can potentially lead to issues when the contract is paused. Users are unable to add margin during the paused state, which can leave them vulnerable to liquidation if their collateral value falls below the required threshold. Additionally, after the contract is unpaused, users can be subject to frontrunning, where their margin addition transactions can be exploited by other users.

In YFX-V3, the function `setPrices` has been called in the beginning of linked functions before further actions. In v4, the `setPrices` can only be called by price provider and the function call requires a fee when the primary price use pyth price feed.

The converted token amount is calculated based on the token's price provided by Chainlink. There is no validation that the price data is not stale and carried over from a previous round. Stale 'carried over' price can be used for deposit, withdrawal, and maintaining reserved balance. This can cause various types of malfunctions and manipulated liquidations. Chainlink feed has two properties that can help determine if the answer is actual (price is fresh): updatedAt time and answeredInRound. Reference: https://docs.chain.link/data-feeds/historical-data This way ChainLink roundId isn't checked in PriceFeed contract used for price discovery and carried over price is treated as fresh in all tokens conversions related computations.

Division operation may result in precision loss due to rounding down, or even the result being erroneously equal to zero when division by large numbers.