BendDAO Invitational
Composable lending and leverage that allows anyone to borrow in an overcollateralized fashion, leverage savings on MakerDAO, leverage stake on Lido, leverage restake with EigenLayer derivatives. Lending and leverage in the same protocol!
- Start date19 Jul 2024
- End date16 Aug 2024
- Total awards$64,000 in USDC
- Duration28 days
- Details
BendDAO audit details
- Total Prize Pool: $64000 in USDC
- HM awards: $53800 in USDC
- QA awards: $2200 in USDC
- Judge awards: $7500 in USDC
- Scout awards: $500 in USDC
- Join C4 Discord to register
- Submit findings using the C4 form
- Read our guidelines for more details
- Starts July 19, 2024 20:00 UTC
- Ends August 16, 2024 20:00 UTC
This is a Private audit
This audit repo and its Discord channel are accessible to certified wardens only. Participation in private audits is bound by:
- Code4rena's Certified Contributor Terms and Conditions
- Code4rena's Certified Contributor Code of Professional Conduct
All discussions regarding private audits should be considered private and confidential, unless otherwise indicated.
Automated Findings / Publicly Known Issues
The 4naly3er report can be found here.
Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.
- Centralisation Risk on Contracts which has Owner or Administrator.
- Questioning the protocol’s business model is unreasonable.
Overview
BendDAO V2 Protocol brings you composable lending and leverage. It allows anyone to borrow in an overcollateralized fashion, leverage savings on MakerDAO, leverage stake on Lido, leverage restake with EigenLayer derivatives, bringing together lending and leverage in the same protocol!
V2 Protocol has three user sides to it:
- Lenders deposit assets to earn passive yield.
- Borrowers can use ERC20 & NFT as collaterals to borrow assets in an overcollateralized fashion.
- Leverage users can use NFT as collaterals to borrow assets to create leverage positions, which can be used across DeFi, NFTs, RWA, etc.
Cool Features
-
Restaking Specialized Loan
BendDAO V2 introduces the first restaking service for NFT holders to earn passive income by Specialized Loan. This groundbreaking feature for bluechip NFTs comes with the V2 update—an exciting development in the realm of DeFi and Restaking. This Restaking Specialized Loan feature, leveraging liquid staking and restaking, is designed to revolutionize how NFT holders can capture ETH ecosystem development benefits when holding NFTs.
-
Cross Margin Lending.
-
Isolated Margin Lending.
-
Custom Lending Pools.
-
Custom Interest Rates.
-
Modularity. V2 Protocol is not just a couple of pools, it's an new architecture of smart contracts which are plug-and-play enabled.
-
Composability. Other protocols can offer leverage to their users with the help of V2 Protocol, without modifying anything in their own architecture.
Links
- Previous audits: None
- Documentation: https://github.com/BendDAO/bend-gitbook-portal-v2
- Website: https://www.benddao.xyz/en/
- X/Twitter: https://twitter.com/BendDAO
- Discord: https://discord.gg/benddao
Scope
See scope.txt
Files in scope
| File | Logic Contracts | Interfaces | nSLOC | Purpose | Libraries used |
|---|---|---|---|---|---|
| /src/ACLManager.sol | 1 | **** | 44 | @openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol | |
| /src/PoolManager.sol | 1 | **** | 69 | src/interfaces/IAddressProvider.sol<br>src/interfaces/IACLManager.sol<br>src/libraries/helpers/Constants.sol<br>src/libraries/helpers/Errors.sol<br>src/libraries/logic/StorageSlot.sol<br>src/libraries/types/DataTypes.sol<br>src/base/Base.sol<br>src/base/Proxy.sol | |
| /src/PriceOracle.sol | 1 | **** | 89 | @openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol<br>@chainlink/contracts/src/v0.8/interfaces/AggregatorV2V3Interface.sol | |
| /src/libraries/helpers/KVSortUtils.sol | 1 | **** | 42 | ||
| /src/libraries/math/MathUtils.sol | 1 | **** | 44 | ||
| /src/libraries/math/PercentageMath.sol | 1 | **** | 22 | ||
| /src/libraries/math/ShareUtils.sol | 1 | **** | 11 | ||
| /src/libraries/math/WadRayMath.sol | 1 | **** | 57 | ||
| /src/libraries/logic/BorrowLogic.sol | 1 | **** | 73 | ||
| /src/libraries/logic/ConfigureLogic.sol | 1 | **** | 421 | @openzeppelin/contracts-upgradeable/utils/structs/EnumerableSetUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/IERC20Upgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/extensions/IERC20MetadataUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/utils/math/SafeCastUpgradeable.sol | |
| /src/libraries/logic/FlashLoanLogic.sol | 1 | **** | 88 | ||
| /src/libraries/logic/GenericLogic.sol | 1 | **** | 264 | @openzeppelin/contracts-upgradeable/utils/structs/EnumerableSetUpgradeable.sol | |
| /src/libraries/logic/InterestLogic.sol | 1 | **** | 179 | @openzeppelin/contracts-upgradeable/utils/structs/EnumerableSetUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/IERC20Upgradeable.sol<br>@openzeppelin/contracts-upgradeable/utils/math/SafeCastUpgradeable.sol | |
| /src/libraries/logic/IsolateLogic.sol | 1 | **** | 335 | ||
| /src/libraries/logic/LiquidationLogic.sol | 1 | **** | 308 | @openzeppelin/contracts-upgradeable/utils/structs/EnumerableSetUpgradeable.sol | |
| /src/libraries/logic/PoolLogic.sol | 1 | **** | 73 | src/interfaces/IDelegateRegistryV2.sol | |
| /src/libraries/logic/StorageSlot.sol | 1 | **** | 11 | ||
| /src/libraries/logic/SupplyLogic.sol | 1 | **** | 151 | ||
| /src/libraries/logic/ValidateLogic.sol | 1 | **** | 437 | @openzeppelin/contracts-upgradeable/utils/structs/EnumerableSetUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC721/IERC721Upgradeable.sol | |
| /src/libraries/logic/VaultLogic.sol | 1 | **** | 427 | @openzeppelin/contracts-upgradeable/utils/structs/EnumerableSetUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/IERC20Upgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC20/utils/SafeERC20Upgradeable.sol<br>@openzeppelin/contracts-upgradeable/token/ERC721/IERC721Upgradeable.sol | |
| /src/libraries/logic/YieldLogic.sol | 1 | **** | 99 | ||
| /src/modules/BVault.sol | 1 | **** | 116 | ||
| /src/modules/Configurator.sol | 1 | **** | 162 | src/base/BaseModule.sol<br>src/libraries/helpers/Constants.sol<br>src/libraries/logic/StorageSlot.sol<br>src/libraries/logic/ConfigureLogic.sol<br>src/libraries/logic/PoolLogic.sol | |
| /src/modules/CrossLending.sol | 1 | **** | 57 | ||
| /src/modules/CrossLiquidation.sol | 1 | **** | 64 | ||
| /src/modules/FlashLoan.sol | 1 | **** | 38 | ||
| /src/modules/IsolateLending.sol | 1 | **** | 58 | ||
| /src/modules/IsolateLiquidation.sol | 1 | **** | 72 | ||
| /src/modules/Yield.sol | 1 | **** | 58 | src/interfaces/IYield.sol | |
| /src/yield/YieldAccount.sol | 1 | **** | 44 | @openzeppelin/contracts/token/ERC20/IERC20.sol<br>@openzeppelin/contracts/token/ERC721/IERC721.sol<br>@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol<br>@openzeppelin/contracts/utils/Address.sol<br>@openzeppelin/contracts/proxy/utils/Initializable.sol<br>src/libraries/helpers/Errors.sol<br>src/interfaces/IYieldRegistry.sol<br>src/interfaces/IYieldAccount.sol | |
| /src/yield/YieldRegistry.sol | 1 | **** | 67 | @openzeppelin/contracts-upgradeable/utils/structs/EnumerableSetUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/proxy/ClonesUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol<br>@openzeppelin/contracts-upgradeable/security/PausableUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol<br>src/interfaces/IAddressProvider.sol<br>src/interfaces/IACLManager.sol<br>src/interfaces/IYieldRegistry.sol<br>src/libraries/helpers/Constants.sol<br>src/libraries/helpers/Errors.sol | |
| /src/yield/YieldStakingBase.sol | 1 | **** | 140 | @openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol<br>@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol<br>@openzeppelin/contracts/utils/math/Math.sol<br>@openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol<br>@openzeppelin/contracts-upgradeable/security/PausableUpgradeable.sol<br>@openzeppelin/contracts-upgradeable/security/ReentrancyGuardUpgradeable.sol<br>src/interfaces/IAddressProvider.sol<br>src/interfaces/IACLManager.sol<br>src/interfaces/IPoolManager.sol<br>src/interfaces/IYield.sol<br>src/interfaces/IPriceOracleGetter.sol<br>src/interfaces/IYieldAccount.sol<br>src/interfaces/IYieldRegistry.sol<br>src/libraries/helpers/Constants.sol<br>src/libraries/helpers/Errors.sol<br>src/libraries/math/PercentageMath.sol<br>src/libraries/math/WadRayMath.sol<br>src/libraries/math/MathUtils.sol<br>src/libraries/math/ShareUtils.sol | |
| /src/yield/etherfi/YieldEthStakingEtherfi.sol | 1 | **** | 102 | @openzeppelin/contracts/utils/math/Math.sol<br>src/interfaces/IPriceOracleGetter.sol<br>src/interfaces/IYieldAccount.sol<br>src/interfaces/IYieldRegistry.sol<br>src/interfaces/IWETH.sol<br>src/libraries/helpers/Constants.sol<br>src/libraries/helpers/Errors.sol | |
| /src/yield/lido/YieldEthStakingLido.sol | 1 | **** | 102 | @openzeppelin/contracts/utils/math/Math.sol<br>src/interfaces/IPriceOracleGetter.sol<br>src/interfaces/IYieldAccount.sol<br>src/interfaces/IYieldRegistry.sol<br>src/interfaces/IWETH.sol<br>src/interfaces/IStETH.sol<br>src/interfaces/IUnstETH.sol<br>src/libraries/helpers/Constants.sol<br>src/libraries/helpers/Errors.sol | |
| /src/yield/sdai/YieldSavingsDai.sol | 1 | **** | 100 | @openzeppelin/contracts/token/ERC20/extensions/IERC20Metadata.sol<br>@openzeppelin/contracts/token/ERC20/utils/SafeERC20.sol<br>@openzeppelin/contracts/utils/math/Math.sol<br>src/interfaces/IPriceOracleGetter.sol<br>src/interfaces/IYieldAccount.sol<br>src/interfaces/IYieldRegistry.sol<br>src/libraries/helpers/Constants.sol<br>src/libraries/helpers/Errors.sol | |
| /src/base/Base.sol | 1 | **** | 48 | @openzeppelin/contracts/security/Pausable.sol<br>@openzeppelin/contracts/token/ERC721/utils/ERC721Holder.sol<br>src/libraries/helpers/Constants.sol<br>src/libraries/helpers/Events.sol<br>src/libraries/helpers/Errors.sol<br>src/base/Storage.sol<br>src/base/Proxy.sol | |
| /src/base/BaseModule.sol | 1 | **** | 21 | ||
| /src/base/Proxy.sol | 1 | **** | 58 | ||
| /src/base/Storage.sol | 1 | **** | 17 | src/libraries/logic/StorageSlot.sol<br>src/libraries/types/DataTypes.sol | |
| /src/libraries/types/DataTypes.sol | 1 | **** | 96 | @openzeppelin/contracts-upgradeable/utils/structs/EnumerableSetUpgradeable.sol | |
| /src/libraries/types/InputTypes.sol | 1 | **** | 167 | ||
| /src/libraries/types/ResultTypes.sol | 1 | **** | 24 | ||
| Totals | 42 | **** | 4855 |
Files out of scope
In addition to beleow, any files not in the list above is Out Of Scope.
See out_of_scope.txt
| File |
|---|
| ./config/ConfigLib.sol |
| ./config/Configured.sol |
| ./script/DeployBase.s.sol |
| ./script/DeployPoolFull.s.sol |
| ./script/DeployPriceAdapter.s.sol |
| ./script/DeployYieldMock.s.sol |
| ./script/DeployYieldStaking.s.sol |
| ./script/InitConfigPool.s.sol |
| ./script/InitConfigYield.s.sol |
| ./script/InstallModule.s.sol |
| ./script/QueryBase.s.sol |
| ./script/QueryPool.s.sol |
| ./script/UpgradeContract.s.sol |
| ./src/AddressProvider.sol |
| ./src/interfaces/IACLManager.sol |
| ./src/interfaces/IAddressProvider.sol |
| ./src/interfaces/IBendNFTOracle.sol |
| ./src/interfaces/IDefaultInterestRateModel.sol |
| ./src/interfaces/IDelegateRegistryV2.sol |
| ./src/interfaces/IFlashLoanReceiver.sol |
| ./src/interfaces/IInterestRateModel.sol |
| ./src/interfaces/IPoolLens.sol |
| ./src/interfaces/IPoolManager.sol |
| ./src/interfaces/IPriceOracle.sol |
| ./src/interfaces/IPriceOracleGetter.sol |
| ./src/interfaces/IStETH.sol |
| ./src/interfaces/IUnstETH.sol |
| ./src/interfaces/IWETH.sol |
| ./src/interfaces/IYield.sol |
| ./src/interfaces/IYieldAccount.sol |
| ./src/interfaces/IYieldRegistry.sol |
| ./src/irm/DefaultInterestRateModel.sol |
| ./src/libraries/helpers/Constants.sol |
| ./src/libraries/helpers/Errors.sol |
| ./src/libraries/helpers/Events.sol |
| ./src/libraries/logic/QueryLogic.sol |
| ./src/modules/Installer.sol |
| ./src/modules/PoolLens.sol |
| ./src/oracles/IDAIPot.sol |
| ./src/oracles/SDAIPriceAdapter.sol |
| ./src/yield/etherfi/ILiquidityPool.sol |
| ./src/yield/etherfi/IWithdrawRequestNFT.sol |
| ./src/yield/etherfi/IeETH.sol |
| ./src/yield/sdai/ISavingsDai.sol |
| ./test/helpers/TestUser.sol |
| ./test/integration/TestACLManager.t.sol |
| ./test/integration/TestDelegateERC721.t.sol |
| ./test/integration/TestIntCollectFeeToTreasury.t.sol |
| ./test/integration/TestIntCrossBorrowERC20.t.sol |
| ./test/integration/TestIntCrossLiquidateERC20.t.sol |
| ./test/integration/TestIntCrossLiquidateERC721.t.sol |
| ./test/integration/TestIntCrossNativeToken.t.sol |
| ./test/integration/TestIntCrossOnBehalf.t.sol |
| ./test/integration/TestIntCrossRepayERC20.t.sol |
| ./test/integration/TestIntDepositERC20.t.sol |
| ./test/integration/TestIntDepositERC721.t.sol |
| ./test/integration/TestIntFlashLoanERC20.t.sol |
| ./test/integration/TestIntFlashLoanERC721.t.sol |
| ./test/integration/TestIntIsolateAuction.t.sol |
| ./test/integration/TestIntIsolateBorrow.t.sol |
| ./test/integration/TestIntIsolateLiquidate.t.sol |
| ./test/integration/TestIntIsolateOnBehalf.t.sol |
| ./test/integration/TestIntIsolateRedeem.t.sol |
| ./test/integration/TestIntIsolateRepay.t.sol |
| ./test/integration/TestIntSetERC721SupplyMode.t.sol |
| ./test/integration/TestIntWithdrawERC20.t.sol |
| ./test/integration/TestIntWithdrawERC721.t.sol |
| ./test/integration/TestIntYieldBorrowERC20.t.sol |
| ./test/integration/TestIntYieldRepayERC20.t.sol |
| ./test/integration/TestPoolLens.t.sol |
| ./test/integration/TestPoolManagerConfig.t.sol |
| ./test/integration/TestPriceOracle.t.sol |
| ./test/mocks/MockBendNFTOracle.sol |
| ./test/mocks/MockChainlinkAggregator.sol |
| ./test/mocks/MockDAIPot.sol |
| ./test/mocks/MockDelegateRegistryV2.sol |
| ./test/mocks/MockERC20.sol |
| ./test/mocks/MockERC721.sol |
| ./test/mocks/MockEtherfiLiquidityPool.sol |
| ./test/mocks/MockEtherfiWithdrawRequestNFT.sol |
| ./test/mocks/MockFaucet.sol |
| ./test/mocks/MockFlashLoanReceiver.sol |
| ./test/mocks/MockSDAI.sol |
| ./test/mocks/MockStETH.sol |
| ./test/mocks/MockUnstETH.sol |
| ./test/mocks/MockWETH.sol |
| ./test/mocks/MockeETH.sol |
| ./test/setup/TestWithBaseAction.sol |
| ./test/setup/TestWithCrossAction.sol |
| ./test/setup/TestWithData.sol |
| ./test/setup/TestWithIsolateAction.sol |
| ./test/setup/TestWithPrepare.sol |
| ./test/setup/TestWithSetup.sol |
| ./test/setup/TestWithUtils.sol |
| ./test/unit/TestPercentageMath.t.sol |
| ./test/unit/TestUnitKVSortUtils.t.sol |
| ./test/unit/TestWadRayMath.t.sol |
| ./test/yield/YieldAccount.t.sol |
| ./test/yield/YieldEthStakingEtherfi.t.sol |
| ./test/yield/YieldEthStakingLido.t.sol |
| ./test/yield/YieldSavingsDai.t.sol |
| Totals: 105 |
Scoping Q & A
General questions
| Question | Answer |
|---|---|
| ERC20 used by the protocol | Any (all possible ERC20s) |
| Test coverage | Lines: 83.12% - Functions: 72.90% |
| ERC721 used by the protocol | Any |
| ERC777 used by the protocol | None |
| ERC1155 used by the protocol | None |
| Chains the protocol will be deployed on | Ethereum, Arbitrum, Optimism, Polygon |
ERC20 token behaviors in scope
| Question | Answer |
|---|---|
| Missing return values | In scope |
| Fee on transfer | In scope |
| Balance changes outside of transfers | In scope |
| Upgradeability | Out of scope |
| Flash minting | Out of scope |
| Pausability | In scope |
| Approval race protections | In scope |
| Revert on approval to zero address | In scope |
| Revert on zero value approvals | In scope |
| Revert on zero value transfers | In scope |
| Revert on transfer to the zero address | In scope |
| Revert on large approvals and/or transfers | In scope |
| Doesn't revert on failure | In scope |
| Multiple token addresses | In scope |
| Low decimals ( < 6) | In scope |
| High decimals ( > 18) | In scope |
| Blocklists | In scope |
External integrations (e.g., Uniswap) behavior in scope:
| Question | Answer |
|---|---|
| Enabling/disabling fees (e.g. Blur disables/enables fees) | Yes |
| Pausability (e.g. Uniswap pool gets paused) | Yes |
| Upgradeability (e.g. Uniswap gets upgraded) | Yes |
EIP compliance checklist
N/A
Additional context
Main invariants
N/A
Attack ideas (where to focus for bugs)
-
Index Overflow Attacks: Interest Rate, e.g. SupplyIndex/BorrowIndex;
-
Multiple Services State Management: Lending & Staking for same NFT; Staking &
ReStaking for the same NFT; Cross & Isolated & Staking the for same account; -
State Manipulation: Oracle Price; Vault’s Token Balance, e.g. directly sending ETH/ERC20/ERC721 to PoolManager contract;
-
Missing Permission checks, e.g. Token’s Ownership, Contract’s Admin;
All trusted roles in the protocol
N/A
Describe any novel or unique curve logic or mathematical models implemented in the contracts:
N/A
Running tests
git clone https://github.com/code-423n4/2024-07-benddao.git
git submodule update --init --recursive
yarn
foundryup
forge test
To run code coverage
forge coverage
To run gas benchmarks:
npm run gas-report
Miscellaneous
Employees of BendDAO and employees' family members are ineligible to participate in this audit.