Audit/v3 lp fixes - #224
Conversation
Adding CLAMM liquidity is the one operation that must not be permissionless: a manipulated pool spot lets a caller force a bad-price re-add and sandwich it. Remove collectAndCompound from every permissionless user flow (deposit, withdraw, withdrawShares, supplyShares, redeemShares) and make compound() BOT-gated with a caller-supplied slippage floor (amount0Min/amount1Min forwarded to increaseLiquidity, previously hardcoded 0/0). Fee re-deployment now happens only via compound() or rebalance, both BOT-gated. No valuation regression: positionAmountsAt already simulates pending fees, so the health-check / oracle valuation stays fee-complete without an inline compound; removeLiquidity still collects the exiter's pro-rata fees. Counter-tests: compound is onlyBot; a deposit no longer deploys idle as liquidity. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…comments with BOT-gating Remove finding-ID / firm / process labels from shipped comments (no logic change): C-1, H02/Issue_04, M01, finding C/C4/D, Codex adv, AUDIT NOTE, "audit PR". Also correct two oracle @dev docstrings that still claimed peek reverts on zero total value (it now floors a dust position), and update the remaining compound comments that described the old permissionless model (compounding is now BOT-gated; user flows no longer compound). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Ceil-round amount0Used/amount1Used in the subsequent-deposit branch so the depositor pays >= their pro-rata share while shares still round down — every sub-wei rounding now favors existing holders and can never dilute the pool. Both legs stay <= the desired input (frac <= dᵢ·WAD/tᵢ), so no over-consumption. Also strip internal finding-id / auditor-name references from the V3 provider test comments (no behavior change; one test renamed accordingly). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The rebase onto master auto-merged two copies of deposit() into IStakeManager (and its mock) at different line positions — no textual conflict, but a duplicate function definition that fails to compile. Remove the redundant declaration; the interface keeps a single deposit()/instantWithdraw(). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Mirror Liquidator.sol's fund-pool integration onto V3Liquidator: - fundSource (LiquidationVault) + reflowBlacklist storage, appended (UUPS-safe). - initialize takes a fundSource arg (0 = legacy); set directly (contract check only — vault registration necessarily happens after the proxy exists) + setFundSource for later. - setFundSource validates the vault has registered this liquidator; setReflowBlacklist. - withdrawERC20/ETH gate relaxed to MANAGER or fundSource so the vault's collect* pulls. - onMoolahLiquidate pulls the exact repayment shortfall from the vault (local balance first). - liquidate/flashLiquidate/redeemV3Shares reflow the residue (loanToken + redeemed legs + native) to the vault; the transfer-restricted V3 share collateral is never reflowed. - liquidate now routes a non-redeeming callback so the pool can fund it, and emits V3Liquidation. fundSource == 0 preserves the exact legacy pre-funded behavior. Counter-tests cover initialize+setFundSource validation, withdraw gate, vault-funded liquidate, and residue reflow. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Pull Request ReviewThis Solidity DeFi PR integrates Sensitive ContentNo sensitive content detected. Security Issues🟡 [MEDIUM] Withdrawal access control is relaxed
Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits. |
…wap leg
In onMoolahLiquidate the native (BNB/ETH) leg was sold with
call{ value: actualRedeemedAmount }, but the bot builds the 1inch swapData
off-chain against a pre-estimated input. Native swaps require msg.value to
equal the amount encoded in the calldata, so the variable actual amount
mismatches and the aggregator reverts — failing the whole flash liquidation.
Send the pre-agreed minTokenNAmt (the value the swapData was built for) as
msg.value instead; redeemShares guarantees actual >= min so the balance always
covers it, and the leftover stays to be wrapped/reflowed. Mirrors the
smart-collateral path in Liquidator.sol. The ERC-20 leg is unaffected (approve
is a ceiling). Counter-test uses a strict aggregator mock (msg.value == amountIn);
V3LiquidatorEth test updated to set minToken1Amt to the native swap input.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Pull Request ReviewThis Solidity DeFi PR integrates Sensitive ContentNo sensitive content detected. Security Issues🟡 [MEDIUM] Access control is relaxed for withdrawal functions
Generated by Hashdit Bot. This tool can absolutely NOT replace manual audits. |
1 participant
📄 Description
Briefly describe the purpose of this PR. Include context and what it solves.
🧠 Rationale
Explain the motivation and necessity of the change. Why was this needed? What problem does it solve?
🧪 Example / Testing
If applicable, provide test scenarios, CLI commands, or example contract interactions.
🧬 Changes Summary
Notable changes: