Code4rena
ARCHIVE-Q3-2023 / venus-sep28
15
3
4 1
1
Hello and welcome to the audit channel for the $36,500 USDC Venus Prime audit!
+
+
Audit opens (20:00 UTC) and runs through (20:00 UTC) (6 days).
+
+Please give a warm welcome to the Venus Protocol team, particularly @0xLucian, @chechu. @kkirka, @narayanprusty, who will be available for questions either here in the channel or via DM in the GMT +1, GMT +2, and GMT +3 timezone(s).
+
+We'll be posting relevant links, documentation, etc. here, so if you intend to participate in this audit, consider enabling notifications for this channel. 
⏰
+
+Audit Page: https://code4rena.com/contests/2023-09-venus-prime#top
15
1
1 
1error: invalid path '.npmignore '
+fatal: unable to checkout working tree
+warning: Clone succeeded, but checkout failed.
+You can inspect what was checked out with 'git status'
+and retry with 'git restore --source=HEAD :/' 
1
1
1 7 2
1
1
1
npm install --force
+
+There were still warning about HH versions not being found, but the install worked and likewise for the tests, there were warning but they executed and passed.npm install --force
+
+There were still warning about HH versions not being found, but the install worked and likewise for the tests, there were warning but they executed and passed. 
m also getting a failure, mine is with Git 🤔
+
+
+Cloning into '2023-09-venus'...
+remote: Enumerating objects: 605, done.
+remote: Counting objects: 100% (605/605), done.
+remote: Compressing objects: 100% (469/469), done.
+remote: Total 605 (delta 124), reused 578 (delta 111), pack-reused 0
+Receiving objects: 100% (605/605), 3.37 MiB | 6.09 MiB/s, done.
+Resolving deltas: 100% (124/124), done.
+error: invalid path '.npmignore '
+fatal: unable to checkout working tree
+warning: Clone succeeded, but checkout failed.
+You can inspect what was checked out with 'git status'
+and retry with 'git restore --source=HEAD :/'
+` 
m also getting a failure, mine is with Git 🤔
+
+
+Cloning into '2023-09-venus'...
+remote: Enumerating objects: 605, done.
+remote: Counting objects: 100% (605/605), done.
+remote: Compressing objects: 100% (469/469), done.
+remote: Total 605 (delta 124), reused 578 (delta 111), pack-reused 0
+Receiving objects: 100% (605/605), 3.37 MiB | 6.09 MiB/s, done.
+Resolving deltas: 100% (124/124), done.
+error: invalid path '.npmignore '
+fatal: unable to checkout working tree
+warning: Clone succeeded, but checkout failed.
+You can inspect what was checked out with 'git status'
+and retry with 'git restore --source=HEAD :/'
+` error: invalid path ".npmignore "
+
+Being the helpful soul, I've raised PR (https://github.com/code-423n4/2023-09-venus/pull/6), it may not be the only fix required, but at least it will move things along to the next Window's specific setup problem. 
m also getting a failure, mine is with Git 🤔
+
+
+Cloning into '2023-09-venus'...
+remote: Enumerating objects: 605, done.
+remote: Counting objects: 100% (605/605), done.
+remote: Compressing objects: 100% (469/469), done.
+remote: Total 605 (delta 124), reused 578 (delta 111), pack-reused 0
+Receiving objects: 100% (605/605), 3.37 MiB | 6.09 MiB/s, done.
+Resolving deltas: 100% (124/124), done.
+error: invalid path '.npmignore '
+fatal: unable to checkout working tree
+warning: Clone succeeded, but checkout failed.
+You can inspect what was checked out with 'git status'
+and retry with 'git restore --source=HEAD :/'
+` 
1
error: invalid path ".npmignore "
+
+Being the helpful soul, I've raised PR (https://github.com/code-423n4/2023-09-venus/pull/6), it may not be the only fix required, but at least it will move things along to the next Window's specific setup problem. 
1
1 7
1
1 2
1
4
1
8 1
1
if you are in a similar situation 
primeRewardToken ? If I understand correctly users stake XVS for 90 days they get a revocable soulbound prime token. How does primeRewardToken come into play? Do they earn that when they have the prime token? Is that USDC, USDT, etc or something else ? primeRewardToken XVS then? 1
2 1
1 1 1
2
1 2
claimInterest feature paused, being conservative. And after confirming the rewards are being allocated as expected unpause it 2
1 1 1 1
2
1PrimeLiquidityProvider get funds ?
2PrimeLiquidityProvider get funds ? 1
1
3
1 1 1issue and getPendingInterests in Prime.sol? issue will be invoked by Governance. getPendingInterests will be invoked (at least) by the Venus dApp, deployed at https://app.venus.io 2 1
1
1
getCode cheatcode to deploy contract and use interfaces to interact with contract. . Did you manage to compile and run your own foundry test? . Did you manage to compile and run your own foundry test? 
! 1Split (4) proportional to the (capped) borrow and supply amounts of the user in that market at that moment XVS tokens.
+This way they incentivize a balance between XVS staked and borrow/supply amounts.XVS tokens.
+This way they incentivize a balance between XVS staked and borrow/supply amounts. Assuming the user has the following positions:
+borrow: 30 USDT. Let's say it's capped at 15 USDT, so we'll consider 15 USDT
+supply: 10 USDT. Let's say it's also capped at 15 USDT, so we'll consider 10 USDT
+what did it capped at mean here ? is it the saved borrrow supply as you mentioned ?A default weight of 0.5 weight has been evaluated as a good ratio and is not likely to be changed. A higher value will only be needed if we want to attract more XVS stake from the Prime token holders at the expense of supply/ borrow rewards.
+
+it says higher value can be setA default weight of 0.5 weight has been evaluated as a good ratio and is not likely to be changed. A higher value will only be needed if we want to attract more XVS stake from the Prime token holders at the expense of supply/ borrow rewards.
+
+it says higher value can be set A higher value of α increases the weight on stake contributions in the determination of rewards and decreases the weight on supply/borrow contributions. The value of α is between 0-1 1Assuming the user has the following positions:
+borrow: 30 USDT. Let's say it's capped at 15 USDT, so we'll consider 15 USDT
+supply: 10 USDT. Let's say it's also capped at 15 USDT, so we'll consider 10 USDT
+what did it capped at mean here ? is it the saved borrrow supply as you mentioned ? 
1 2 1 1 1 https://hardhat.org/hardhat-runner/docs/advanced/hardhat-and-foundry
2
A higher value of α increases the weight on stake contributions in the determination of rewards and decreases the weight on supply/borrow contributions. The value of α is between 0-1 
1 1
3
https://hardhat.org/hardhat-runner/docs/advanced/hardhat-and-foundry 
XVS staked amount for user i and Sum of qualified supply and borrow balance for user i (with corresponded pows, of course) in formula from https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/README.md#rewards
+
+Because if consider case from Wiki: https://en.wikipedia.org/wiki/Cobb–Douglas_production_function#Formulation here Y is total production, but what is Y for Prime?
XVS staked amount for user i and Sum of qualified supply and borrow balance for user i (with corresponded pows, of course) in formula from https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/README.md#rewards
+
+Because if consider case from Wiki: https://en.wikipedia.org/wiki/Cobb–Douglas_production_function#Formulation here Y is total production, but what is Y for Prime? XVS staked amount for user iSum of qualified supply and borrow balance for user i 4 struct Interest {
+ uint256 accrued;
+ uint256 score;
+ uint256 rewardIndex;
+ } markets[vToken].rewardIndex is the variable where the income to be distributed divided by the sum of the user scores is accumulated. Visually, it is the red area of the rewards formula you can find attached and in the following link: https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/README.md#rewards
1markets[vToken].rewardIndex is the variable where the income to be distributed divided by the sum of the user scores is accumulated. Visually, it is the red area of the rewards formula you can find attached and in the following link: https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/README.md#rewards 
interests[market][account].rewardIndex is the same concept, but per user. So, we can use it to really know how much rewards we have to allocate for a user.
+
+Example:
+markets[vToken].rewardIndex +0.4 (this can be interpreted like: any Prime holder will receive 0.4 USDT per score point, associated to the block period 0-10)markets[vToken].rewardIndex is incremented with +0.2markets[vToken].rewardIndex will be updated (invoking accrueInterest from _initializeMarkets). In these 5 blocks the income was 5 USDT and the sum of users scores didn't change, so we increment markets[vToken].rewardIndex with +0.1
+ then interests[market][account].rewardIndex will be set to markets[market].rewardIndex. This means something like: the track of this users start at this point, when markets[market].rewardIndex was 0.7 (0.4 + 0.2 + 0.1)markets[vToken].rewardIndex will be updated (invoking accrueInterest from getInterestAccrued). In these 15 blocks the income was 120 USDT, and the sum of user scores changed (because we have a new Prime holder). Let's assume the num sum of user scores is 60, so markets[vToken].rewardIndex is incremented with +2. New markets[vToken].rewardIndex is 2.7
+ then, the interest for the user are calculated in _interestAccrued. To do that, first we subtract interests[market][account].rewardIndex from markets[vToken].rewardIndex: 2.7 - 0.7 = 2 (USDT per score point) and then we multiply that number times the user score (10): 2 * 10 = 20 USDT: interests accrued by the user until now 5Prime::_capitalForScore, the oracle.getPrice(xvsToken) and oracle.getUnderlyingPrice(market) return a value in 1e18 decimals ? Or can be other decimals depends on the market ? 36 - decimals(underlying token). Examples:
+ 1
issue will be invoked by Governance. getPendingInterests will be invoked (at least) by the Venus dApp, deployed at https://app.venus.io 
1
burn doesn't have access limited anyone could burn your Prime token. We cannot allow that. Just wanted to know, should I deploy the real one or the mock is functionally the same? 
PrimeLiquidityProvider? 
1
deposit function. Then waits 90 days and claims his Prime token with the claim function in Prime.sol. Once the use has a prime token he is basically receiving interest that can be collected at any time with claimInterest in Prime.sol. Understanding the logic behind the reward system is up to you. 2score-10 && interest-2 USDC => reward of 20 USDC deposit function. Then waits 90 days and claims his Prime token with the claim function in Prime.sol. Once the use has a prime token he is basically receiving interest that can be collected at any time with claimInterest in Prime.sol. Understanding the logic behind the reward system is up to you. 1score-10 && interest-2 USDC => reward of 20 USDC 1
rewardIndex to me ? is it like a multiplier ? rewardIndex is basically interest without the score
+https://discordapp.com/channels/810916927919620096/1154526680434610176/1158285262489665587 1rewardIndex.
+rewardIndex is used to track how much gap is between these two rewardIndex.
+For example, when a user _claimInterest(), his rewardIndex becomes equal to the market's rewardIndex.
+@chechu If I'm wrong, please correct me 2
stakedAt? xvsUpdated() ?stakedAt? /**
+ * @notice Used to get if the XVS balance is eligible for prime token
+ * @param amount amount of XVS
+ * @return isEligible true if the staked XVS amount is enough to consider the associated user eligible for a Prime token, false otherwise
+ */
+ function isEligible(uint256 amount) internal view returns (bool) {
+ if (amount >= MINIMUM_STAKED_XVS) {
+ return true;
+ }
+
+ return false;
+ } 
1 1PrimeLiquidityProvider? 
1
rewardIndex to me ? is it like a multiplier ? rewardIndex here: https://discord.com/channels/810916927919620096/1154526680434610176/1158101841846997104
+
+and here: https://discord.com/channels/810916927919620096/1154526680434610176/1158107050774114315
+
+including an example 1 1 1 2
, I could not finish the setup due to a single oracle contract, I found its mock contract but I could not understand what parameter it needs, and the contracts in scope is updating the oracle asserts and tokens underlining due to that I could not setup this completely. But if anyone can find the workaround then can use this.
+
+https://github.com/alymurtazamemon/foundry-playground-for-venus-audit.git
1Prime.sol, when needed.
+However they are still in their contract PSRincome and PLPincome, when sent (released) they will be reset to 0. 2
1
1
3
2
3 1 12
3
1 8
1 
_checkAccessAllowed() ?? accessControl.isAllowedToCall.returns(true);_checkAccessAllowed() because it is out of scope anyways 1getPendingInterests function? is it prime tokens?
+
+edit:
+the answer is here:
+https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/README.md#income-collection-and-distribution 2getPendingInterests function? is it prime tokens?
+
+edit:
+the answer is here:
+https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/README.md#income-collection-and-distribution 4 1 1 7 3 2
, I could not finish the setup due to a single oracle contract, I found its mock contract but I could not understand what parameter it needs, and the contracts in scope is updating the oracle asserts and tokens underlining due to that I could not setup this completely. But if anyone can find the workaround then can use this.
+
+https://github.com/alymurtazamemon/foundry-playground-for-venus-audit.git 
@chechu
1 1 1 1
1 _checkAccessAllowed will be called by governance through VIP (Venus Improvement Proposal) 1
+@chechu
+@kkirka
+@narayanprusty
+@Manmeet22
1 1
1
1 3 1 1
1
AUDIT ALERT
+
+@🐺wardens The Venus Prime audit is now closed! Huge thanks to everyone who participated 
, whether you submitted a finding or not.
+
+What's next: The sponsor team and judge will review the findings over the next couple of weeks. Keep an eye on #📢announcements for regular updates on how the audit is progressing through awarding 
, judging 
️ and reporting 
. Feel free to ping a Contest-Admin if you have questions along the way!
7 2 3
1
7 10 4 2
4
2
Awards for Venus Prime:
+
+$10,783.76 USDC » @Testerbot
+$1,161.45 USDC » @0xDetermination
+$983.50 USDC » @Brenzee
+$859.90 USDC » @ether_sky
+$855.53 USDC » @SpicyMeatball
+$853.09 USDC » @Breeje
+$814.29 USDC » @tapir
+$786.38 USDC » @santipu_
+$719.26 USDC » @0xTheC0der
+$689.32 USDC » @sces60107 | GimelSec
+$661.42 USDC » @pep7siup
+$661.42 USDC » @ast3ros
+$360.09 USDC » @said
+$332.18 USDC » @Priyam
+$327.81 USDC » @rokinot
+$235.12 USDC » @blutorque
+$235.12 USDC » @neumo
+$235.12 USDC » PwnStars (@sakshamguruji, @qbs)
+$235.12 USDC » ThreeSigma (@0x73696d616f, @Carolina, @Eduardo, @SolidityDev99)
+$230.76 USDC » Pessimistic (@PavelCore,@yhtyyar, @olegggatttor)
+$223.09 USDC » @David Giladi
+$211.72 USDC » @oakcobalt
+$202.85 USDC » @seerether
+$202.85 USDC » @Norah
+$202.85 USDC » DeFiHackLabs (@SunSec, @AkshaySrivastav, @Sm4rty, @Cache_And_Burn, @ret2basic.eth, @zuhaibmohd, @sashik_eth, @Ronin)
+$202.85 USDC » @bin2chen
+$202.85 USDC » @hals
+$198.48 USDC » @deadrosesxyz
+$198.48 USDC » @dirk_y
+$198.48 USDC » @turvy_fuzz
+$185.96 USDC » @0xprinc
+$179.45 USDC » @0x3b
+$166.82 USDC » @deth
+$163.76 USDC » @J4X
+$157.24 USDC » @0xsload
+$129.33 USDC » @mahdiRostami
+$129.33 USDC » @HChang26
+$129.33 USDC » @rvierdiiev
+$129.33 USDC » @0xpiken
+$129.33 USDC » @twicek
+$129.33 USDC » @berlin.101
+$129.33 USDC » @KrisApostolov
+$129.33 USDC » @Doogoo
+$129.33 USDC » @gkrastenov
+$129.33 USDC » @merlin
+$128.12 USDC » @lsaudit
+$124.96 USDC » @sl1
+$124.96 USDC » @aycozynfada
+$123.75 USDC » @ICP
+$123.75 USDC » @0xhacksmithh
+$98.12 USDC » @Bauchibred
+$62.21 USDC » @josephdara
+$53.88 USDC » @0xweb3boy
+$36.64 USDC » @Piña
+$36.64 USDC » @xAriextz
+$36.64 USDC » @al88nsk
+$32.27 USDC » @debo
+$32.27 USDC » @ADM
+$32.27 USDC » @tsvetanovv
+$32.27 USDC » @0xblackskull
+$32.27 USDC » @dethera
+$32.27 USDC » @Deleted User
+$32.27 USDC » SBSecurity (@Blckhv, @Slavcheww)
+$21.61 USDC » @ArmedGoose
+$20.05 USDC » @0xWaitress
+$20.05 USDC » @jkoppel
+$17.24 USDC » @James
+$17.24 USDC » @versiyonbir
+$17.24 USDC » @kaveyjoe
+$17.24 USDC » @hunter_w3b
+$17.24 USDC » @radev_sw
+$15.69 USDC » @hihen
+$15.69 USDC » @pontifex
Findings summary
+--------------------------------------—
+High risk findings: 3 unique (53 total)
+Med risk findings: 2 unique (24 total)
+Gas reports: 11 (Best: @David Giladi)
+QA reports: 88 (Best: @Bauchibred)
+Advanced analysis reports: 14 (Best: @Priyam)
+
+Awards will be distributed on Polygon within the next week. Congratulations all! 
+
+Note: If you participated in this audit and don’t see your name on this list, please wait until the report is published and the findings repo is made public to check on your submissions. 5
1
2
+It was a good audit with a well-written codebase. 1 1
1
♂️
1 8
