YFX - security record

According to the code at line 47 and lines 49-52, we can infer that: 1. If the off-chain price has not been updated for longer than `priceDuration`, it is considered an error in the off-chain price feed service, and the `Chainlink` price needs to be adjusted up or down by $2‰$. 2. If the off-chain price has not been updated for longer than `maxPriceUpdateDelay`, it is considered that the off-chain price feed service is inactive, and the `Chainlink` price needs to be adjusted up or down by $5\\%$. However, based on the logic and comments in the `getPrice()` function, we can see the opposite design: 1. If the off-chain price has not been updated for longer than `priceDuration`, the `Chainlink` price is adjusted by $5\\%$. 2. If the off-chain price has not been updated for longer than `maxPriceUpdateDelay`, the `Chainlink` price is adjusted by $2‰$.

The attribute `longMakerFreeze` in the `DataByMarket` data structure represents long position assets, while the attribute `shortMakerFreeze` represents short position assets. However, the comments and variable names express different meanings.

The assignment of the state variable `marketType` occurs only after the `initialize()` function of the `Market` contract is called. Therefore, the validation of the market type through the `checkoutConfig()` function of the `MarketLogic` contract is only effective after the initialization of the `Market` contract. However, in the `createPair()` function of the `Manager` contract, the logic in lines 299 to 301 validates the `Market` contract configuration before the initialization of the `Market` contract. This results in the `marketType` state variable always being zero, causing the validation to fail in line 601 of the `checkoutConfig()` function.

```solidity=62 require(!marketConfig.updateMarginPaused, "Market:Set price paused"); ``` The correct error message should be `Market: Update margin paused`. --- ```solidity=310 require(position.amount > 0, "Market:order not exist"); ``` According to the logic of the code at lines 309-310, we can infer that its purpose is to verify whether the specified position exists. Therefore, if the boolean expression `position.amount > 0` returns false, the error message should be `Market: position does not exist`.

The `asset` parameter in the `createPair()` function represents the collateral token of the market and should align with the value of the `baseAsset` state variable in the `Pool` contract. However, the current code logic lacks validation for the values of `asset` and `baseAsset`.

Addresses should be checked before assignment or external call to make sure they are not zero addresses. ```solidity=29 manager = _manager; ``` - `_manager` is not zero-checked before being used. --- ```solidity=59 manager = _manager; ``` - `_manager` is not zero-checked before being used. --- ```solidity=93 tradeToken = _tradeToken; ``` - `_tradeToken` is not zero-checked before being used. --- ```solidity=99 inviteToken = _inviteToken; ``` - `_inviteToken` is not zero-checked before being used. --- ```solidity=33 fundingLogic = _fundingLogic; ``` - `_fundingLogic` is not zero-checked before being used. --- ```solidity=74 marginAsset = _marginAsset; ``` - `_marginAsset` is not zero-checked before being used. --- ```solidity=75 pool = _pool; ``` - `_pool` is not zero-checked before being used. --- ```solidity=92 fundingLogic = _fundingLogic; ``` - `_fundingLogic` is not zero-checked before being used. --- ```solidity=32 manager = _manager; ``` - `_manager` is not zero-checked before being used. --- ```solidity=37 marketPriceFeed = _marketPriceFeed; ``` - `_marketPriceFeed` is not zero-checked before being used. --- ```solidity=43 WETH = _WETH; ``` - `_WETH` is not zero-checked before being used. --- ```solidity=44 vault = IManager(_manager).vault(); ``` - `_manager` is not zero-checked before being used. --- ```solidity=458 marketPriceFeed = _marketPriceFeed; ``` - `_marketPriceFeed` is not zero-checked before being used. --- ```solidity=22 manager = _manager; ``` - `_manager` is not zero-checked before being used. --- ```solidity=36 rewardAsset = _rewardAsset; ``` - `_rewardAsset` is not zero-checked before being used. --- ```solidity=42 manager = _manager; ``` - `_manager` is not zero-checked before being used. --- ```solidity=43 WETH = _WETH; ``` - `_WETH` is not zero-checked before being used. --- ```solidity=103 manager = _manager; ``` - `_manager` is not zero-checked before being used. --- ```solidity=113 marketPriceFeed = _marketPriceFeed; ``` - `_marketPriceFeed` is not zero-checked before being used. --- ```solidity=58 manager = _manager; ``` - `_manager` is not zero-checked before being used. --- ```solidity=67 chainlinkFlags = _chainlinkFlags; ``` - `_chainlinkFlags` is not zero-checked before being used. --- ```solidity=72 priceHelper = _priceHelper; ``` - `_priceHelper` is not zero-checked before being used. --- ```solidity=94 secondaryPriceFeed = _secondaryPriceFeed; ``` - `_secondaryPriceFeed` is not zero-checked before being used. --- ```solidity=17 manager = _manager; ``` - `_manager` is not zero-checked before being used.

The `removeLiquidity()` function of the `Pool` contract includes the maker address information in its return value. However, the caller of this function, the `Router` contract, only uses the function's return value at lines 464 and 482, without utilizing the `maker` address information. Therefore, the return value can be safely removed.

Such a judgment and requirement is strange and useless. ```solidity=88 if (fundingLogic != address(0)) { require(fundingLogic != address(0), "Market: invalid funding logic contract address"); } ```

According to the code logic, we know that when the value of `block.timestamp` surpasses the `deadline`, the creation of open/close position orders is prohibited, resulting in the failure of invoking the `takerOpen()/takerClose()/takerOpenETH()` functions. We want to know more information about the `deadline` variable.

The state variable `sharePrice` represents the value of an `LP` token in terms of the `baseAsset`. In the following two scenarios, `totalSupply` is zero, but the value of `sharePrice` is different. 1. When the state variable `sharePrice` is initialized to zero, it indicates that the `Pool` contract has been deployed and `totalSupply` is also zero. 2. In the `executeRmLiquidityOrder()` function, lines 313-317, when liquidity is removed and `totalSupply` becomes zero, the value of the state variable `sharePrice` is set to `1e10`. This may result in erroneous display of interface data.