- Join Sherlock Discord
- Submit findings using the issue page in your private contest repo (label issues as med or high)
- Read for more details
mainnet
DAI, sDAI, wETH, veFXS, FXS, OHM
UNI-V3
No
None
No
No
TRUSTED
TRUSTED
The Bophades system includes support for permissions and roles, which the in-scope contracts utilise.
In the in-scope modules (TRSRY, PRICE and SPPLY), some functions are gated with the permissioned modifier. These functions can only be called by a policy that has explicitly listed that function selector as a dependency in the policy's requestPermissions() function. Policies can only be installed and activated by the system owner (at this time, the OlympusDAO multi-sig). These permissioned functions are largely configuration/admin-related, and other functions (such as view functions) are un-gated.
Q: Is the code/contract expected to comply with any EIPs? Are there specific assumptions around adhering to those EIPs that Watsons should be aware of?
No
The PRICE submodules that use an on-chain method to access the reserves of a liquidity pool or positions are susceptible to sandwich attacks and multi-block manipulation - Assets in PRICEv2 can be configured to track the moving average of an asset price in order to mitigate this risk - Assets in PRICEv2 can be configured with multiple price feeds and a reconciliation strategy (e.g. average, median, average if a deviation is present) in order to mitigate this risk - Where possible, PRICE submodules will check for re-entrancy in the source (e.g. liquidity pool). This has been implemented in the BalancerPoolTokenPrice and Uniswap submodule.
The SPPLY submodules that use an on-chain method to access the reserves of a liquidity pool or positions are susceptible to sandwich attacks and multi-block manipulation - Where possible, downstream consumers of the data need to conduct sanity-checks. - Where possible, SPPLY submodules will check for re-entrancy in the source (e.g. liquidity pool). This has been implemented in the AuraBalancerSupply submodule. - To guard against multi-block manipulation, where possible, SPPLY submodules will compare the implied price from reserves against the price from TWAP. This has been implemented in the BunniSupply submodule.
https://docs.olympusdao.finance/main/security/audits/
Q: Are there any off-chain mechanisms or off-chain procedures for the protocol (keeper bots, input validation expectations, etc)?
No
Q: In case of external protocol integrations, are the risks of external contracts pausing or executing an emergency withdrawal acceptable? If not, Watsons will submit issues related to these situations that can harm your protocol's functionality.
Such risks would not be acceptable, as the TRSRY, PRICE and SPPLY modules collectively track and manage the Olympus protocol treasury and token supply. Emergency withdrawals would affect the treasury valuation and/or token supply, and hence higher-level metrics (such as liquid backing per backed OHM), which would affect other components of the protocol.
Q: Do you expect to use any of the following tokens with non-standard behaviour with the smart contracts?
DAI
https://docs.olympusdao.finance/
Please also see relevant audit documentation in the repository:
- audit/23-11_price-v2/README.md
- audit/23-11_spply_trsry/README.md
bophades @ e0b5cd259d7a84db3a329dab3932ec8664ae1323
- bophades/src/Submodules.sol
- bophades/src/libraries/Deviation.sol
- bophades/src/libraries/UniswapV3/BunniHelper.sol
- bophades/src/libraries/UniswapV3/Oracle.sol
- bophades/src/modules/PRICE/OlympusPrice.v2.sol
- bophades/src/modules/PRICE/PRICE.v2.sol
- bophades/src/modules/PRICE/submodules/feeds/BalancerPoolTokenPrice.sol
- bophades/src/modules/PRICE/submodules/feeds/BunniPrice.sol
- bophades/src/modules/PRICE/submodules/feeds/ChainlinkPriceFeeds.sol
- bophades/src/modules/PRICE/submodules/feeds/ERC4626Price.sol
- bophades/src/modules/PRICE/submodules/feeds/UniswapV2PoolTokenPrice.sol
- bophades/src/modules/PRICE/submodules/feeds/UniswapV3Price.sol
- bophades/src/modules/PRICE/submodules/strategies/SimplePriceFeedStrategy.sol
- bophades/src/modules/SPPLY/OlympusSupply.sol
- bophades/src/modules/SPPLY/SPPLY.v1.sol
- bophades/src/modules/SPPLY/submodules/AuraBalancerSupply.sol
- bophades/src/modules/SPPLY/submodules/BLVaultSupply.sol
- bophades/src/modules/SPPLY/submodules/BunniSupply.sol
- bophades/src/modules/SPPLY/submodules/CustomSupply.sol
- bophades/src/modules/SPPLY/submodules/IncurDebtSupply.sol
- bophades/src/modules/SPPLY/submodules/MigrationOffsetSupply.sol
- bophades/src/modules/SPPLY/submodules/SentimentArbSupply.sol
- bophades/src/modules/SPPLY/submodules/SiloArbSupply.sol
- bophades/src/modules/SPPLY/submodules/SiloSupply.sol
- bophades/src/modules/TRSRY/OlympusTreasury.sol
- bophades/src/modules/TRSRY/TRSRY.v1.sol