[AURA] bauraBal staking vault

[shuklaayush]

Strategy Review

Description

Stake auraBal to get rewards

• bal -> auraBal
• aura -> graviAura

Code Link

https://github.com/shuklaayush/auraBal-staker/tree/v0.0.4

Due Diligence Document (Link, but could also just be a .md file in repo)

Aura Aura Report yet to be released, from my own knowledge meaningful bugs where mitigated: https://code4rena.com/reports

Balancer: https://docs.balancer.fi/security/audits

Deployed Contract (If present)

Review By

• Ongoing: [] @GalloDaSballo
• Completed:

Review by Security Board

• Not started / ongoing / completed

Test Checks (screen shot of all test passing)

Launch Checklist

• [x] Strategy development - Strategist
• [x] Strategy fork testing - Strategist/QA Pod
• [x] Strategy review - Solidity Pod/QA pod
• [x] Contracts deployment and initialization - Strategist/QA Pod
• [x] Addition of vault to the Badger Registry - Strategist/QA Pod
• [x] Wire-up of contracts to the UI (On-chain with RegistryV2) - UI/API pod
• [x] Guestlist deployment and setup (If guarded launch) - Strategist/QA Pod
• [x] Test deposit through the UI - Strategist/QA Pod
• [x] Production tests of operational functions (Earn, Harvest, Tend) - Strategist/QA Pod
• [x] Add vault/strategy addresses to the keeper bot - Emissions Pod
• [x] Test a rewards claim (If new reward token is emitted) - Strategist/QA Pod
• [x] APY and balance on UI verification - Strategist/QA Pod
• [x] User Guide and Strategy diagram - Comms pod
• [x] Contract addresses additions to Docs - Comms/QA pod
• [x] Contracts delegation - Strategist/QA Pod
• [x] Contracts' Production parameters and delegation verification - Solidity/QA pod
• [x] Production launch - UI/API Pod
• [x] Announcements - Comms pod

[GalloDaSballo]

Review: Tests are passing

Function for Minting is scraped from AuraToken, would like to see a couple tests against it just to be sure

Gas: AURA.INIT_MINT_AMOUNT(); AURA.reductionPerCliff() totalCliffs EMISSIONS_MAX_SUPPLY

Are all constants / immutable could just be hardcoded for cheaper gas, although they are for view function so prob doesn't matter

[GalloDaSballo]

Question: Harvests have 0 minOut, anything we can do to make it better?

[GalloDaSballo]

Question: Do we have option to lock vs buy from pool for some of these swaps?

[aj-maz]

General Review:

• [x] Tests are passing

Functions Review:

• [x] setClaimRewardsOnWithdrawAll
• [ ] setBalEthBptToAuraBalMinOutBps
• [x] getName
• [x] getProtectedTokens
• [x] _deposit
• [x] _isTendable
• [ ] _harvest
• [ ] _tend
• [ ] balanceOfPool
• [ ] balanceOfRewards
• [ ] getMintableAuraRewards

[shuklaayush]

Function for Minting is scraped from AuraToken, would like to see a couple tests against it just to be sure

Added test for minting calculation https://github.com/shuklaayush/auraBal-staker/blob/241840f1641616a912c160854a703a987f1e7330/tests/test_custom.py#L27-L50

Are all constants / immutable could just be hardcoded for cheaper gas, although they are for view function so prob doesn't matter

Yep, these would only be called from off-chain

Harvests have 0 minOut, anything we can do to make it better?

We can but should be fine if we harvest using flashbots like in other strategies

Do we have option to lock vs buy from pool for some of these swaps?

Yes we do, but calculating the optimal way requires simulating the swap which might be expensive in balancer

https://github.com/balancer-labs/balancer-v2-monorepo/blob/d2794ef7d8f6d321cde36b7c536e8d51971688bd/pkg/vault/contracts/Swaps.sol#L447-L539

[sajanrajdev]

Review

Description

Strategy that takes auraBAL as want and stakes it on the rewards pool for more rewards. Upon harvest, it autocompounds the BAL received and emits all of the AURA in the form of graviAURA.

Features

• Includes flag to allow for rewards claiming upon withdrawAll() (NOTE: _withdrawAll can only be called by the vault and it only handled the want token. If rewards are claimed when withdrawing for a broken harvest for instance, AURA and BAL won't be processed and stuck on the strat as they are protected tokens. The broken strat will need to be upgraded to remove the protection or to fix harvest in order for these rewards to be rescued. It is still handy to claim all rewards when exiting a position fully - AURA rewards are calculated at claim time based on the totalSupply and, if they are left unclaimed for a long time, the claimable amount may be reduced considerably).
• The claimable AURA amount is estiamated by mimicking the minting logic - same logic as CVX - this function is kept public so could be leveraged as needed externally. LG.

Notes

@shuklaayush

• All hardcoded addresses LGTM
• We should consider setting a default value for the balEthBptToAuraBalMinOutBps upon initialize to save us the trouble of calling afterwards.
• What if, after _reportToVault is called and fees are processed, we re-stake (_deposit) the outstanding amount to increase the position atomically?

  Yes we do, but calculating the optimal way requires simulating the swap which might be expensive in balancer

• Just to confirm, I went ahead to compare the gas consumption differences between joining the BPT + swapping, joining the BPT + locking, and locking directly from BAL to auraBAL through Aura's zap. References:
  1. Provide Liq and swap (Gas: 174,773+135,589):
• Provide liq to BPT with single sided BAL: https://etherscan.io/tx/0x6ec6c5d08b17c00220c288492a0fa374620fc1708cc75836987e5f509703988b
• BPT for auraBAL swap: https://etherscan.io/tx/0x41f194f180318b8314587ddfd1c20659a98476b203b3d132935d1d7871afd133

2. Provide liq and lock (Gas: 174,773 + 314,272):

   • Provide liq to BPT with single sided BAL: https://etherscan.io/tx/0x6ec6c5d08b17c00220c288492a0fa374620fc1708cc75836987e5f509703988b
   • Lock: https://etherscan.io/tx/0xff2bb082cb861ca70860fe68da639b51d961b1b65192734c57f6ec08ec247863

3. Direct BAL -> auraBAL deposit through Aura (Gas: 588,184): https://etherscan.io/tx/0x0f17866a94f6b68c501a1a3ba396987776c432bd5cd3960a6dd36d4db0c1b02d

So if we won't dynamically choose the best path, it seems like the current approach leads to the least gas consuming for the time being

Testing

Test cover the different scenarios expected for this strat (resolver checks tree and autocompounding), the rewards estimation logic and that the claim on withdraw flag works as expected with its proper permissions. All tests are passing and LGTM:

[GalloDaSballo]

@shuklaayush I've noticed that fees where changed, @Tritium-VLK pls confirm fees before deployment

[shuklaayush]

We should consider setting a default value for the balEthBptToAuraBalMinOutBps upon initialize to save us the trouble of calling afterwards.

Good catch. Fixed

What if, after _reportToVault is called and fees are processed, we re-stake (_deposit) the outstanding amount to increase the position atomically?

Sure sir

[sajanrajdev]

• Slippage protection set on init
• Staking earned want amount after harvest process

Tests are still passing:

LGTM!

[shuklaayush]

Deployment

Vault proxy: 0x37d9D2C6035b744849C15F1BFEE8F268a20fCBd8

Strategy proxy: 0xfB490b5beA343ABAe0E71B61bBdfd4301F5e4df9

Strategy logic: 0x500C5Aa6661B7d40fBcB05c6bd9bdC9e63f3C5AA

Guestlist: 0x6f54b4f2179b4125C4992a33FFB89e5322E26523

Caps

Total cap set at 85k auraBal and no user cap.

Current prices:

• Bal: $4.75
• Eth: $1116

80bal-20eth pool:

• Invariant: 3501000.4
• Total supply: 6902277.5

Price of bpt can be calculated as

$$ \begin{align} p_{bpt} &= \frac{Invariant}{TotalSupply}\cdot \left(\frac{p_1}{w_1}\right)^{w_1} \cdot \left(\frac{p_2}{w_2}\right)^{w_2}\ &= \frac{3501000.4}{6902277.5}\cdot \left(\frac{4.75}{0.8}\right)^{0.8} \cdot \left(\frac{1116}{0.2}\right)^{0.2}\ &\approx $11.84 \end{align} $$

Assuming 1 auraBal = 1 veBal = 1 80bal-20eth bpt

• 85k auraBal ~ $1mn

[sajanrajdev]

Deployments review

Vault

• Logic: TheVault.sol, same one used for graviAura

Parameters:

• Token: auraBAL
• Governance: deployer to be delegated (@shuklaayush)
• Guardian: WarRoomACL
• Guestlist: Set to the above
• Keeper: KeeperACL
• Treasury: Trops
• Mgmt fee: 0
• Performance fee gov: 10%
• Performance fee strat: 0
• Withdrawal fee: 0

Actors LG and fees confirmed with @Tritium-VLK LGTM

Strategy

• Logic: Matches that of the latest release (diff)

Paramters:

• balEthBptToAuraBalMinOutBps: 9500 (95%)
• want: auraBAL
• Strategist: TechOps
• Protected tokens: auraBal, Aura, BAL

LGTM

Guestlist

Caps Math checks out

• Total cap: 85K BAL
• User cap: Max uint256
• Root: 0x0

LGTM

General

Deployments, logics and parameters LGTM

[shuklaayush]

Harvest: https://etherscan.io/tx/0x09376a5c2a024db8eb2fdc47c46fb19f9de1a0e66638bb293f0a5e194d814fa8 Governance delegation: https://etherscan.io/tx/0x0ed843ee7b87165acc3948cda7034077c33f60817eb65dbe64e9126b9e973152

[shuklaayush]

Update to emit bb-a-usd https://github.com/shuklaayush/auraBal-staker/tree/v0.1.3

Diff: https://github.com/shuklaayush/auraBal-staker/compare/v0.0.4...v0.1.3

[sajanrajdev]

Changes Review

• Introduced handling for the bb-a-usd emissions by depositing into b-bb-a-usd helper and emitting
• Added function to approve bb-a-usd on helper after upgrade
• Added bb-a-usd to protected tokens list
• Modified balanceOfRewards to show the expected bb-a-usd to be harvested as well

Changes LGTM

Testing

• Adapted resolver to check for bbb-a-usd emissions upon harvest
• Added test to ensure that balance of rewards properly account bb-a-usd
• Added an upgrade test to ensure integrity is kept and the strategy will work as expected post-upgrade

All tests are passing, including upgrade test:

Test harvest shows proper handling of bb-a-usd and no dust:

Test changes LGTM

Overall

LGTM

[shuklaayush]

New strategy deployments

Proxy: 0xED6d51A82065725e283fC035f488213e869FD976

Logic: 0x959927641c65A9FA13C6102091BC0cCdDB827D77

[sajanrajdev]

New strategy deployments

Proxy: 0xED6d51A82065725e283fC035f488213e869FD976

Logic: 0x959927641c65A9FA13C6102091BC0cCdDB827D77

New deployed strategy actors and parameters LGTM. Address already applied to migration script which further confirms proper logic and functioning through simulation: https://github.com/Badger-Finance/badger-multisig/pull/635

LGTM

[sajanrajdev]

Migration to new strategy executed; https://etherscan.io/tx/0xf8b99c319f881b9486b018ca20b1d6789c2d520fc1fcc00262187a827e015f10

[GalloDaSballo]

Harvested over the weekend and then guarded launch over next week

[sajanrajdev]

Governance delegation: https://etherscan.io/tx/0x0ed843ee7b87165acc3948cda7034077c33f60817eb65dbe64e9126b9e973152

[Tritium-VLK]

@shuklaayush Per feedback from the beta-squad, can we change the bauraBAL vault to autocompound USD for more auraBAL instead of emitting it s bobba?

https://discord.com/channels/743271185751474307/996717380023631892/1001560433406246952

[sajanrajdev]

Latest deployment of version that autocompounds BB-A-USD by @shuklaayush : https://etherscan.io/address/0x32BdF2B35Bbf8dAca3561C3ADE59c941488E9c69#readProxyContract

Review

• All actors LGTM
• Already delegated to devMulti
• Logic matches latest
• Confirmed Proxyadmin to be devProxyAdmin:

Deployment LGTM

Migration script

Ready for review: https://github.com/Badger-Finance/badger-multisig/pull/721

[sajanrajdev]

Strategy difference for reference: https://www.diffchecker.com/CbqkLoPp

Current logic: https://etherscan.io/address/0x959927641c65a9fa13c6102091bc0ccddb827d77#code New logic: https://etherscan.io/address/0x79b9cb36b6cb7ecb073de493aa2b9c5995854a21#code

[GalloDaSballo]

Closing as succesful