search

Fujicracy / fuji-v2

Cross-chain money market aggregator
https://fuji-v2-frontend.vercel.app
15 stars 10 forks source link

CS - BaseVault lack of slippage protection #198

Closed 0xdcota closed 1 year ago

0xdcota commented 1 year ago

Where: https://github.com/Fujicracy/fuji-v2/blob/ab02d2308797577973ac358af8c7aadf973bcec7/packages/protocol/src/abstracts/BaseVault.sol#L24

Description: The EIP-4626 standard is not meant to be used directly by EAOs. The deposit, mint, redeem, withdraw function can be subject to slippage and have no specific protection. Users should be allowed to verify if the received amount of shares or assets is as expected.

Recommendation: ● Extend the vaults’ logic with functions described in EIP-5143 standard. ● Implement the ERC4626Router to interact with the vaults through.

0xdcota commented 1 year ago

Implemented EIP5143 and the flavor of it for debt actions in the BorrowingVault. However, BorrowingVault contract is now bit out of contract size limits.

will work on finding a few optimizations to reduce this. Otherwise, will change the compiler optimization runs.

BorrowingVault ┆ 24.604 ┆ -0.028

0xdcota commented 1 year ago

To not loop too much into bytecode reduction I decided to simply reduce the number of compiler optimizations from 1000 runs to 750. This action freed-up almost 1Kb in the BorrowingVault.sol contract.

@brozorec the associated PR is ready for review.