Stonks is a sophisticated solution designed for token exchange utilizing an off-chain CoW swap platform. This system allows token swaps to be performed securely without the tokens in balance being managed by a professional token management committee within the DAO framework.
Revision 1.0
Lido Finance collaborated with Ackee Blockchain and donated a total of 7 days of engineering time from January 28 to February 5, 2024 to conduct a security review of the Lido Finance protocol.
Revision 1.1
A revision review was performed on that commit. 4c51f22. Issues M1, W1, W3, I1, I2, I3 and I4 were fixed as per recommendations. Warnings W2 and W4 were acknowledged as unlikely in relation to the client’s intent.
Revision 1.2
Lido Finance leveraged Ackee Blockchain to ensure that contracts deployed on the Ethereum mainnet matched the reviewed codebase. Verification was performed on commit. 40af0bb If there have been minor changes since the last review of the scoped contract:
methodology
The Lido Stonks contract was tested with a differential fuzz test written in the Wake testing framework.
We began our review using static analysis tools, including Wake. We then took a closer look at the logic of the contract. At the same time, we have included a wake test framework to implement differential fuzz testing along with fork testing, including Chainlink simulations.
During fuzz testing, I found issues with M1, W1, and W3.
During the review process, we paid special attention to the following:
- Accuracy of Chainlink integration;
- Compliant with EIP-1271 standard,
- Verify that the system’s calculations are correct,
- Detect possible reentrancy in your code,
- Ensure access controls are neither too relaxed nor too strict
- Look for common problems such as data validation,
- Search for possible gas optimization.
Revision 1.1
A revision review was performed on that commit. 4c51f22. Issues M1, W1, W3, I1, I2, I3 and I4 were fixed as per recommendations. Warnings W2 and W4 were acknowledged as unlikely in relation to the client’s intent.
Revision 1.2
Lido Finance leveraged Ackee Blockchain to ensure that contracts deployed on the Ethereum mainnet matched the reviewed codebase. Verification was performed on commit. 40af0bb If there have been minor changes since the last review of the scoped contract:
- stokes
- Stokes Factory
- money converter
- Money converter factory
- Bespeak
range
An audit has been performed on the commit. edf39c7 The exact scope was the following files:
Revision 1.0: An audit was initially performed on commits. edf39c7.
Revision 1.1: Review of the last delivered commit continued. 4c51f22.
Revision 1.2: A review of the commit has been performed. 40af0bb.
result
We present our findings here.
critical severity
No critical severity issues were found.
Severity High
No high severity issues were found.
medium severity
M1: SafeERC20 Not used for approval
low severity
No low-severity issues were found.
warning severity
W1: MIN_POSSIBLE_BALANCE inadequate logic
W2: Chainlink feed registry mainnet only
W3: InvalidExpectedOutAmount get back
W4: Assume stablecoins are stable
Information Severity
I1: Unused code
I2: Missing events
I3: Duplicate code
I4: Typos and documentation
conclusion
The review yielded nine findings ranging from informational to moderate severity.
The most serious problem is the violation of the protocol when using non-standard ERC-20 tokens such as USDT (see M1). The overall code quality is solid, follows best practices, and includes appropriate data validation. The code was fully covered with detailed NatSpec documentation, and developers provided comprehensive specifications for onboarding.
Ackee Blockchain recommends Lido Finance:
- Instead, use ‘SafeERC20.forceApprove’ or ‘SafeERC20.safeIncreaseAllowance’.
- ‘ERC20.Approved’,
- Chainlink data feed limitations (deviation threshold, general
- heartbeat) may be a factor limiting fairness evaluation,
- Don’t assume that a stablecoin will always be worth $1.
- Addresses all other reported issues.
Ackee Blockchain’s full Lido Finance audit report, which includes a detailed description of all findings and recommendations, can be found here.
We were delighted to thank Lido Finance and look forward to working with them again.