Brief audit of `vAMM2.ride` - Githubissues

Tsunami-Exchange / tsunami-contracts

Tsunami Exchange Smart Contracts (RIDE)

2 stars 3 forks source link

Brief audit of `vAMM2.ride` #4

Open deemru opened 2 years ago

deemru commented 2 years ago

MEDIUM: Wrong (because of updated price vs previous price usage) and unnecessary lastCumulativePrice calculation in else branch: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6858c82c92dc31f45b8294c6fc4239e9f9f64714/contracts/ride/vAMM2.ride#L588-L595 You only need to update the price in this branch: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6858c82c92dc31f45b8294c6fc4239e9f9f64714/contracts/ride/vAMM2.ride#L596
MEDIUM: You need at least TWAP_INTERVAL + 1 to guarantee you always have a value out of TWAP_INTERVAL range: https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6858c82c92dc31f45b8294c6fc4239e9f9f64714/contracts/ride/vAMM2.ride#L577
LOW: Empty list leads to 0 as result of getTwapSpotPrice() if it is not possible it would be better to throw() here (and do not use valueOrElse(0) in this function at all): https://github.com/Tsunami-Exchange/tsunami-contracts/blob/6858c82c92dc31f45b8294c6fc4239e9f9f64714/contracts/ride/vAMM2.ride#L486