Back

Zunami Protocol v2

2/6/2024Published
ID
Severity
Status
Title 14 Findings
Location
C-01
CRITICAL
FIXED

No access control for deposit function call in VaultStrat

VaultStrat.sol
C-02
CRITICAL
FIXED

Blocking execution of inflate and deflate functions in ConvexCurveStratBase

ConvexCurveStratBase.sol
C-03
CRITICAL
FIXED

Elevated price in USD in the getLiquidityTokenPrice function leads to money theft from the pool in ZunamiStratBase

ZunamiStratBase.sol
C-04
CRITICAL
FIXED

Price-feed returns ETH price in FrxETHOracle

FrxETHOracle.sol
M-01
MAJOR
FIXED

Latency of APS logic in CrvUsdApsConvexCurveStratBase, FraxApsConvexCurveStratBase

CrvUsdApsConvexCurveStratBase.sol
FraxApsConvexCurveStratBase.sol
M-02
MAJOR
FIXED

Array out of bounds in _setTokens when deleting tokens in ZunamiPool

ZunamiPool.sol
W-01
WARNING
ACKNOWLEDGED

High slippage in CrvUsdApsConvexCurveStratBase, FraxApsConvexCurveStratBase

CrvUsdApsConvexCurveStratBase.sol
FraxApsConvexCurveStratBase.sol
W-02
WARNING
FIXED

Underflow in case of depositedValue is lower than MINIMUM_LIQUIDITY on the first deposit to the strategy in ZunamiPool

ZunamiPool.sol
I-01
INFO
FIXED

Inflation attack in ZunamiPool

ZunamiPool.sol
I-02
INFO
FIXED

Redundant extension of the AccessControl contract to check two roles at once in AccessControl2RolesValuation

AccessControl2RolesValuation.sol
I-03
INFO
FIXED

Parameter validation

FraxApsConvexCurveStratBase.sol
CrvUsdApsConvexCurveStratBase.sol
ConvexCurveStratBase.sol
CurveStratBase.sol
StakeDaoCurveStratBase.sol
RecapitalizationManager.sol
StakingRewardDistributor.sol
ZunDistributor.sol
GenericOracle.sol
ZunamiStratBase.sol
I-04
INFO
FIXED

Using constant in CurveStratBase

CurveStratBase.sol
ERC4626StratBase.sol
I-05
INFO
ACKNOWLEDGED

High decimals tokens support in ZunamiStratBase

ZunamiStratBase.sol
I-06
INFO
ACKNOWLEDGED

Floating pragma

Please select finding