DESCRIPTION
The target of this audit is the private code repository of Perp Contracts of HertzFlow. Please refer to the report for the detailed audit scope.
Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.
In summary, we have found that the codebase contains 2 high-risk issues that require prompt attention. In addition, we have identified other non-critical issues as well as recommendations and notes that should be considered. The Perp Contracts team has addressed these issues promptly. It is important to note that our audit covers only the final reported versions of the codebase. Any subsequent updates would require a re-evaluation.
KEY FINDINGS
In total, we find 8 potential issues in the smart contract. We also have 5 recommendations and 7 notes, as follows:
| ID | Severity | Description | Status |
|---|---|---|---|
| 1 | High | Improper loss rebate design due to the dependence of the collateral amount | Fixed |
| 2 | High | Incorrect check in function _validateBorrowReserve() |
Fixed |
| 3 | Medium | Circumvention of self-referral restriction via the function transferCode() |
Confirmed |
| 4 | Medium | Loss rebate extraction using hedging positions | Confirmed |
| 5 | Medium | Improper claimable accounting due to malicious transfers | Confirmed |
| 6 | Medium | Incorrect bank revocation logic | Fixed |
| 7 | Medium | Griefing attack via cross-bank redemption | Fixed |
| 8 | Low | Lack of mapping between WrappedToken and underlying asset |
Fixed |
| 9 | - | Add a decimal check for the input _rewardToken |
Confirmed |
| 10 | - | Add non-zero checks in the function batchSetXP() |
Confirmed |
| 11 | - | Add validations in function _validateMarketTokens() |
Fixed |
| 12 | - | Correct error name for receiver balance check | Fixed |
| 13 | - | Remove redundant code | Fixed |
| 14 | - | Potential centralization risks | - |
| 15 | - | Ensure sufficient USDT reserves in the contract CreditProfitClaimVault |
- |
| 16 | - | Exclude the credit token market from HLV creations | - |
| 17 | - | Configuration assumptions | - |
| 18 | - | Weird ERC20 tokens | - |
| 19 | - | Assumptions of the borrowing mechanism | - |
| 20 | - | Proper adaptations between the credit and lego modules | - |
More details are provided in the audit report.
