Read the findings of the 2022 Web3 Security Report

The UniSwap, Compound and ETH conventions are used while the token is to be deployed on the Fantom chain.

Naming does not match operating environment

The following functions are declared as `public`, contain array function arguments, and are not invoked in any of the contracts contained within the project's scope. The functions that are never called internally within the contract should have external visibility. 

Function Visibility Optimization

The contract has unlocked compiler version. An unlocked compiler version in the source code of the contract permits the user to compile it at or above a particular version. This, in turn, leads to differences in the generated bytecode between compilations due to differing compiler version numbers. This can lead to an ambiguity when debugging as compiler specific bugs may occur in the codebase that would be hard to identify over a span of multiple compiler versions rather than a specific one.

Unlocked Compiler Version

In the contract `DiscLendtroller`, the role `admin` has authority over the following functions:
- `function _setPriceOracle()`
- `function _setCloseFactor()`
- `function _setCollateralFactor()`
- `function _setLiquidationIncentive()`
- `function _supportMarket()`
- `function _setMarketBorrowCaps()`
- `function _setBorrowCapGuardian()`
- `function _setPauseGuardian()`
- `function _setMintPaused()`
- `function _setBorrowPaused()`
- `function _setTransferPaused()`
- `function _setSeizePaused()`
- `function _become()`
- `function _grantComp()`
- `function _setCompSpeed()`
- `function _setContributorCompSpeed()`


Any compromise to the `admin` account may allow a hacker to take advantage of this authority and modify all Disc token parameters such as the oracle, collateral factor, etc.

Centralization Related Risks in DiscLendtroller.sol

In the contract `DiscLendPriceOracle`, the role `owner` has authority over the following functions:
- `setGovernor()`
- `setPeriod()`

Any compromise to the `owner` account may allow a hacker to take advantage of this authority and add and remove governors at will and change updating periods.

In the contract `DiscLendPriceOracle`, the role `Governor` has authority over the following functions:
- `initPairInfo()`
- `setDirectPrice()`
- `updatePairPrices()`

Any compromise to the `Governor` account may allow a hacker to take advantage of this authority and initialize asset pairs and even set any arbitrary price to any asset.

Centralization Related Risks in DiscLendPriceOracle.sol

The contract is serving as the underlying entity to interact with third party `SpookySwap` protocol. The scope of the audit treats 3rd party entities as black boxes and assume their functional correctness. However, in the real world, 3rd parties can be compromised and this may lead to lost or stolen assets. In addition, upgrades of 3rd parties can possibly create severe impacts, such as increasing fees of 3rd parties, migrating to new LP pools, etc.

Third Party Dependencies

The `initPairInfo()` function does not check whether the `oraclePairMapping` for the given pair has already been initialized or not.

oraclePairMapping duplication not checked

The logic of the `updatePairPrices` assumes that the `_token` parameter is one of the `_pair`. However this could not be the case.

`_token` pertaining in the `_pair` not checked

What is the `uint` of this mapping reflecting? The price of a token in relation to which other currency?

What would this value be if anyone calls `updatePairPrices(address _pair, address _token)` twice with two different `_pair` values, but the same `_token`?

What is the `uint` of this mapping reflecting?

All of the `DISC` tokens are sent to the contract deployer when deploying the contract. This could be a centralization risk as the deployer can distribute `DISC` tokens without obtaining the consensus of the community.

Initial Token Distribution

Inconsistent comment. 720000e18 != 1 million

Inconsistent comment

Disc Finance

DiscLendtroller.sol

Disc Finance

Highlights & Alerts

This is just a placeholder

highlight placeholder lorem Ipsum...

highlight lorem

This is a alert demo

Alert demo

Code Audit History

11

0

11

0

0