If you notice some outdated information please let us know!
PASS
The final review score is indicated as a percentage. The percentage is calculated as Achieved Points due to MAX Possible Points. For each element the answer can be either Yes/No or a percentage. For a detailed breakdown of the individual weights of each question, please consult this document.
Very simply, the audit looks for the following declarations from the developer's site. With these declarations, it is reasonable to trust the smart contracts.
This report is for informational purposes only and does not constitute investment advice of any kind, nor does it constitute an offer to provide investment advisory or other services. Nothing in this report shall be considered a solicitation or offer to buy or sell any security, token, future, option or other financial instrument or to offer or provide any investment advice or service to any person in any jurisdiction. Nothing contained in this report constitutes investment advice or offers any opinion with respect to the suitability of any security, and the views expressed in this report should not be taken as advice to buy, sell or hold any security. The information in this report should not be relied upon for the purpose of investing. In preparing the information contained in this report, we have not taken into account the investment needs, objectives and financial circumstances of any particular investor. This information has no regard to the specific investment objectives, financial situation and particular needs of any specific recipient of this information and investments discussed may not be suitable for all investors.
Any views expressed in this report by us were prepared based upon the information available to us at the time such views were written. The views expressed within this report are limited to DeFiSafety and the author and do not reflect those of any additional or third party and are strictly based upon DeFiSafety, its authors, interpretations and evaluation of relevant data. Changed or additional information could cause such views to change. All information is subject to possible correction. Information may quickly become unreliable for various reasons, including changes in market conditions or economic circumstances.
This completed report is copyright (c) DeFiSafety 2023. Permission is given to copy in whole, retaining this copyright label.
This section looks at the code deployed on the relevant chain that gets reviewed and its corresponding software repository. The document explaining these questions is here.
1. Are the smart contract addresses easy to find? (%)
Smart contract addresses can be found here and they were easy to find. A screenshot of the addresses can be found in the appendix.
2. How active is the primary contract? (%)
The Booster contract is active with more than 10 transactions a day. A screenshot of the transactions analytics can be found in the appendix.
3. Does the protocol have a public software repository? (Y/N)
GitHub Repository: https://github.com/aurafinance
4. Is there a development history visible? (%)
The aura-contracts is active with more than 100 commits.
5. Is the team public (not anonymous)?
The team seems to be operating under anonymity.
This section looks at the software documentation. The document explaining these questions is here.
7. Is the protocol's software architecture documented? (Y/N)
This protocol's software architecture is documented in their Diagrams page within the README.md of the aura-contract repository.
8. Does the software documentation fully cover the deployed contracts' source code? (%)
There were no clear software function documentation that could be found outside of the diagrams' one-liners.
9. Is it possible to trace the documented software to its implementation in the protocol's source code? (%)
There were no clear software function documentation that could be found outside of the diagrams' one-liners.
10. Has the protocol tested their deployed code? (%)
Code examples are in the Appendix at the end of this report.. As per the SLOC, there is 352% testing to code (TtC). This score is guided by the Test to Code ratio (TtC). Generally a good test to code ratio is over 100%. However, the reviewer's best judgement is the final deciding factor.
11. How covered is the protocol's code? (%)
There is no evidence of code coverage, but there is a clear set of tests. Need a publicly available visual on code coverage. https://github.com/aurafinance/aura-contracts#coverage
12. Does the protocol provide scripts and instructions to run their tests? (Y/N)
Scripts/Instructions location: https://github.com/aurafinance/aura-contracts#test
13. Is there a detailed report of the protocol's test results?(%)
Test reports are available in the Actions' tab of the aura-contracts' repository. This can be accessed here
14. Has the protocol undergone Formal Verification? (Y/N)
This protocol has not undergone formal verification.
15. Were the smart contracts deployed to a testnet? (Y/N)
Testnet deployment addresses can be found here on Kovan and Goerli.
This section looks at the 3rd party software audits done. It is explained in this document.
16. Is the protocol sufficiently audited? (%)
All 3 audits made on Aura finance are available [here], with Peckshield, Code4rena and Halborn. With multiple pre-launch audits and important issues being resolved, the protocol earns 100%.
17. Is the bounty value acceptably high (%)
This protocol offers an active bug bounty of $1M
This section covers the documentation of special access controls for a DeFi protocol. The admin access controls are the contracts that allow updating contracts or coefficients in the protocol. Since these contracts can allow the protocol admins to "change the rules", complete disclosure of capabilities is vital for user's transparency. It is explained in this document.
18. Is the protocol's admin control information easy to find?
All contracts are clearly labeled as immutable. Otherwise, admin functions can be found here
19. Are relevant contracts clearly labelled as upgradeable or immutable? (%)
All contracts are clearly labeled as immutable. Otherwise, admin functions can be found here
20. Is the type of smart contract ownership clearly indicated? (%)
21. Are the protocol's smart contract change capabilities described? (%)
All contracts are clearly labeled as immutable. Otherwise, admin functions can be found here
22. Is the protocol's admin control information easy to understand? (%)
This information is not in software specific language.
23. Is there sufficient Pause Control documentation? (%)
Aura Finance clearly mentions the non-custodial nature of the platform makes pause controls not a necessity here. For that matter, the protocol will earn 100%.
24. Is there sufficient Timelock documentation? (%)
Aura Finance mentions the non-custodial nature of its platform as the reason of an absence of timelock here. For that matter, the protocol will earn full marks.
25. Is the Timelock of an adequate length? (Y/N)
Aura Finance mentions the non-custodial nature of its platform as the reason of an absence of timelock here. For that matter, the protocol will earn full marks.
This section goes over the documentation that a protocol may or may not supply about their Oracle usage. Oracles are a fundamental part of DeFi as they are responsible for relaying tons of price data information to thousands of protocols using blockchain technology. Not only are they important for price feeds, but they are also an essential component of transaction verification and security. These questions are explained in this document.
26. Is the protocol's Oracle sufficiently documented? (%)
Aura Finance clearly does not utilize oracles. For that matter, the oracles' section will be voided.
27. Is front running mitigated by this protocol? (Y/N)
Aura Finance clearly does not utilize oracles. For that matter, the oracles' section will be voided.
28. Can flashloan attacks be applied to the protocol, and if so, are those flashloan attack risks mitigated? (Y/N)
Aura Finance clearly does not utilize oracles. For that matter, the oracles' section will be voided.
1pragma solidity 0.8.11;
2
3import { IERC20 } from "@openzeppelin/contracts-0.8/token/ERC20/IERC20.sol";
4import { SafeERC20 } from "@openzeppelin/contracts-0.8/token/ERC20/utils/SafeERC20.sol";
5import { Ownable } from "@openzeppelin/contracts-0.8/access/Ownable.sol";
6import { ReentrancyGuard } from "@openzeppelin/contracts-0.8/security/ReentrancyGuard.sol";
7import { AuraMath, AuraMath32, AuraMath112, AuraMath224 } from "../utils/AuraMath.sol";
8import { IAuraLocker } from "../interfaces/IAuraLocker.sol";
9import { IRewardStaking } from "../interfaces/IRewardStaking.sol";
10
11/**
12 * @title AuraLocker
13 * @author ConvexFinance
14 * @notice Effectively allows for rolling 16 week lockups of CVX, and provides balances available
15 * at each epoch (1 week). Also receives cvxCrv from `CvxStakingProxy` and redistributes
16 * to depositors.
17 * @dev Individual and delegatee vote power lookups both use independent accounting mechanisms.
18 */
19contract AuraLocker is ReentrancyGuard, Ownable, IAuraLocker {
20 using AuraMath for uint256;
21 using AuraMath224 for uint224;
22 using AuraMath112 for uint112;
23 using AuraMath32 for uint32;
24 using SafeERC20 for IERC20;
25
26 /* ========== STRUCTS ========== */
27
28 struct RewardData {
29 /// Timestamp for current period finish
30 uint32 periodFinish;
31 /// Last time any user took action
32 uint32 lastUpdateTime;
33 /// RewardRate for the rest of the period
34 uint96 rewardRate;
35 /// Ever increasing rewardPerToken rate, based on % of total supply
36 uint96 rewardPerTokenStored;
37 }
38 struct UserData {
39 uint128 rewardPerTokenPaid;
40 uint128 rewards;
41 }
42 struct EarnedData {
43 address token;
44 uint256 amount;
45 }
46 struct Balances {
47 uint112 locked;
48 uint32 nextUnlockIndex;
49 }
50 struct LockedBalance {
51 uint112 amount;
52 uint32 unlockTime;
53 }
54 struct Epoch {
55 uint224 supply;
56 uint32 date; //epoch start date
57 }
58 struct DelegateeCheckpoint {
59 uint224 votes;
60 uint32 epochStart;
61 }
62
63 /* ========== STATE VARIABLES ========== */
64
65 // Rewards
66 address[] public rewardTokens;
67 mapping(address => uint256) public queuedRewards;
68 uint256 public constant newRewardRatio = 830;
69 // Core reward data
70 mapping(address => RewardData) public rewardData;
71 // Reward token -> distributor -> is approved to add rewards
72 mapping(address => mapping(address => bool)) public rewardDistributors;
73 // User -> reward token -> amount
74 mapping(address => mapping(address => UserData)) public userData;
75 // Duration that rewards are streamed over
76 uint256 public constant rewardsDuration = 86400 * 7;
77 // Duration of lock/earned penalty period
78 uint256 public constant lockDuration = rewardsDuration * 17;
79
80 // Balances
81 // Supplies and historic supply
82 uint256 public lockedSupply;
83 // Epochs contains only the tokens that were locked at that epoch, not a cumulative supply
84 Epoch[] public epochs;
85 // Mappings for balance data
86 mapping(address => Balances) public balances;
87 mapping(address => LockedBalance[]) public userLocks;
88
89 // Voting
90 // Stored delegations
91 mapping(address => address) private _delegates;
92 // Checkpointed votes
93 mapping(address => DelegateeCheckpoint[]) private _checkpointedVotes;
94 // Delegatee balances (user -> unlock timestamp -> amount)
95 mapping(address => mapping(uint256 => uint256)) public delegateeUnlocks;
96
97 // Config
98 // Blacklisted smart contract interactions
99 mapping(address => bool) public blacklist;
100 // Tokens
101 IERC20 public immutable stakingToken;
102 address public immutable cvxCrv;
103 // Denom for calcs
104 uint256 public constant denominator = 10000;
105 // Staking cvxCrv
106 address public immutable cvxcrvStaking;
107 // Incentives
108 uint256 public kickRewardPerEpoch = 100;
109 uint256 public kickRewardEpochDelay = 3;
110 // Shutdown
111 bool public isShutdown = false;
112
113 // Basic token data
114 string private _name;
115 string private _symbol;
116 uint8 private immutable _decimals;
117
118 /* ========== EVENTS ========== */
119
120 event DelegateChanged(address indexed delegator, address indexed fromDelegate, address indexed toDelegate);
121 event DelegateCheckpointed(address indexed delegate);
122
123 event Recovered(address _token, uint256 _amount);
124 event RewardPaid(address indexed _user, address indexed _rewardsToken, uint256 _reward);
125 event Staked(address indexed _user, uint256 _paidAmount, uint256 _lockedAmount);
126 event Withdrawn(address indexed _user, uint256 _amount, bool _relocked);
127 event KickReward(address indexed _user, address indexed _kicked, uint256 _reward);
128 event RewardAdded(address indexed _token, uint256 _reward);
129
130 event BlacklistModified(address account, bool blacklisted);
131 event KickIncentiveSet(uint256 rate, uint256 delay);
132 event Shutdown();
133
134 /***************************************
135 CONSTRUCTOR
136 ****************************************/
137
138 /**
139 * @param _nameArg Token name, simples
140 * @param _symbolArg Token symbol
141 * @param _stakingToken CVX (0x4e3FBD56CD56c3e72c1403e103b45Db9da5B9D2B)
142 * @param _cvxCrv cvxCRV (0x62B9c7356A2Dc64a1969e19C23e4f579F9810Aa7)
143 * @param _cvxCrvStaking cvxCRV rewards (0x3Fe65692bfCD0e6CF84cB1E7d24108E434A7587e)
144 */
145 constructor(
146 string memory _nameArg,
147 string memory _symbolArg,
148 address _stakingToken,
149 address _cvxCrv,
150 address _cvxCrvStaking
151 ) Ownable() {
152 _name = _nameArg;
153 _symbol = _symbolArg;
154 _decimals = 18;
155
156 stakingToken = IERC20(_stakingToken);
157 cvxCrv = _cvxCrv;
158 cvxcrvStaking = _cvxCrvStaking;
159
160 uint256 currentEpoch = block.timestamp.div(rewardsDuration).mul(rewardsDuration);
161 epochs.push(Epoch({ supply: 0, date: uint32(currentEpoch) }));
162 }
163
164 /***************************************
165 MODIFIER
166 ****************************************/
167
168 modifier updateReward(address _account) {
169 {
170 Balances storage userBalance = balances[_account];
171 uint256 rewardTokensLength = rewardTokens.length;
172 for (uint256 i = 0; i < rewardTokensLength; i++) {
173 address token = rewardTokens[i];
174 uint256 newRewardPerToken = _rewardPerToken(token);
175 rewardData[token].rewardPerTokenStored = newRewardPerToken.to96();
176 rewardData[token].lastUpdateTime = _lastTimeRewardApplicable(rewardData[token].periodFinish).to32();
177 if (_account != address(0)) {
178 userData[_account][token] = UserData({
179 rewardPerTokenPaid: newRewardPerToken.to128(),
180 rewards: _earned(_account, token, userBalance.locked).to128()
181 });
182 }
183 }
184 }
185 _;
Tests to Code: 8591 / 2438 = 352 %