Audit cyfrin #155

gonzaloetjo · 2025-05-28T15:30:28Z

Linked issues

Solved

Fix C01 (Middleware) - Dust limit attack on forceUpdateNodes allows DoS of rebalancing and potential vault insolvency #163
Fix C-02 (Middleware): Future epoch cache manipulation via calcAndCacheStakes allows reward manipulation #164
Fix H-01 (VaultFactory): Blacklisted vault implementation versions are accessible through migrations #160
Fix H02 (DelegatorFactory) - New entity can be created for a blacklisted implementation #161
Fix H06 (Rewards) - Incorrect Summation of Curator Shares in claimUndistributedRewards Leads to Deficit in Claimed Undistributed Rewards (Now H03) #171
Fix H04 (Rewards) - Incorrect reward claim logic causes loss of access to intermediate epoch rewards #154
Fix H07 (Rewards - Middleware) - Timestamp boundary condition causes reward dilution for active operators (Now H05) #172
Fix H03 (Middleware) - Immediate stake cache updates enable reward distribution without P-Chain confirmation (Now H06) #165
Fix H07 (Rewards) - Vault rewards incorrectly scaled by cross-asset-class operator totals instead of asset class specific shares causing rewards leakage #197
Fix H09 (Rewards) - Not All Reward Token's Rewards Are Claimable (Now H08) #174
Fix H10 (Rewards) - Division by zero in rewards distribution can cause permanent lock of epoch rewards (Now H09) #175
Fix M-01 (VaultTokenized): Vault initialization allows deposit whitelist with no management capability #158
Fix M02 (VaultTokenized) - Vault initialization allows zero deposit limit with no ability to modify causing denial of service #159
Fix M07 (VaultTokenized) - Potential underflow in slashing logic (Now M03) #170
Fix M03 (Checkpoints) - Wrong value is returned in upperLookupRecentCheckpoint (Now M04) #162
Fix M04 (Middleware) - Inconsistent Stake Calculation Due to Mutable vaultManager Reference in AvalancheL1Middleware (Now M05) #167
Fix M05 (Middleware) - Insufficient validation in AvalancheL1Middleware::removeOperator can create permanent validator lockup (Now M08) #168
Fix H04 (Middleware) - Operator stake misattributed due to reused nodeId due to historical lookup flaw (Now M09) #166
Fix M06 (Middleware) - Incorrect Inclusion of Removed Nodes in _requireMinSecondaryAssetClasses During forceUpdateNodes (Now M10) #169
Fix H08 (Rewards) - Rewards system DOS due to unchecked asset class share and fee allocations (Now M11) #173
Fix M08 (Rewards) - Operators Can Lose Their Reward Share (Now M12) #177
Fix M09 (Middleware) - Inaccurate Stake Calculation Due to Decimal Mismatch Across Multi-Token Asset Classes (Now M14) #178
Fix M10 (Rewards) - Accumulative Reward Setting to Prevent Overwrite and Support Incremental Updates (Now M15) #179
Fix M11 (Rewards) - Rewards distribution DoS due to uncached secondary asset classes (Now M16) #180
Fix M12 (Uptime) - Uptime loss due to integer division in UptimeTracker::computeValidatorUptime can make validator lose entire rewards for an epoch (Now M17) #181

On-going:

Aknowledged

H11 (Uptime) - Inaccurate Uptime Distribution in computeValidatorUptime Function Leads to Reward Discrepancies (Now H10) #176

Changes

Modified tests o work correctly (some may be missing in this list):

H09
H10
M09

leopaul36 · 2025-06-16T08:30:04Z

src/contracts/middleware/AvalancheL1Middleware.sol

+            emit AllNodeStakesUpdated(operator, newTotalStake);
+            return;


This should probably be a revert

leopaul36 · 2025-06-16T08:35:41Z

src/contracts/middleware/AvalancheL1Middleware.sol

@@ -812,8 +803,27 @@ contract AvalancheL1Middleware is IAvalancheL1Middleware, AssetClassRegistry {
        if (!balancerValidatorManager.isValidatorPendingWeightUpdate(validationID)) {
            revert AvalancheL1Middleware__WeightUpdateNotPending(validationID);
        }
-        // if the completeValidatorWeightUpdate fails, not sure if the previous bool is secure.
+
+        // Finish the weight update on the P-Chain


Comment is not super acurate. Could be "Complete weight update upon P-Chain confirmation"

leopaul36 · 2025-06-16T08:39:22Z

src/contracts/middleware/AvalancheL1Middleware.sol

            // Check ratio vs. class's min stake, could add an emit here to debug
-            if (stake / (nodeCount + extraNode) < assetClasses[classId].minValidatorStake) {
+            if (stake / nodeCount < assetClasses[classId].minValidatorStake) {
+                emit DebugSecondaryAssetClassCheck(operator, classId, stake, nodeCount, assetClasses[classId].minValidatorStake);


DebugSecondaryAssetClassCheck event should be removed

leopaul36 · 2025-06-16T08:39:40Z

src/contracts/middleware/AvalancheL1Middleware.sol

            // Check ratio vs. class's min stake, could add an emit here to debug
-            if (stake / (nodeCount + extraNode) < assetClasses[classId].minValidatorStake) {
+            if (stake / nodeCount < assetClasses[classId].minValidatorStake) {
+                emit DebugSecondaryAssetClassCheck(operator, classId, stake, nodeCount, assetClasses[classId].minValidatorStake);


DebugSecondaryAssetClassCheck event should be removed

octane-security-app · 2025-06-16T09:14:50Z

Summary by Octane

New Contracts

MockERC20WithDecimals.sol: The contract is an ERC20 token implementation with customizable decimals and an initial supply minted to the deployer.

Updated Contracts

DelegatorFactory.sol: Added blacklist check to prevent creation of certain delegator types.
VaultFactory.sol: Implemented a blacklist check to prevent upgrades to specific versions.
Checkpoints.sol: Replaced self._values[checkpoint._value] with checkpoint._value in return values for efficiency.
AvalancheL1Middleware.sol: The smart contract now includes stricter operator validation, improved stake management with epoch delays, and enhanced handling of node updates and removals.
MiddlewareVaultManager.sol: Removed address storage in the vaults and adjusted time comparison logic for determining vault activity.
Rewards.sol: The contract now supports concurrent fee updates, epoch status tracking, asset class-specific share calculation, prevents reentrancy, and includes epoch funding/distribution constraints.
UptimeTracker.sol: The smart contract now fairly distributes leftover uptime seconds across epochs, skipping processed epochs.
VaultTokenized.sol: The updated smart contract introduces role consistency checks, deposit limit controls, overflow checks, and redistributes slashed stakes with new events.
IDelegatorFactory.sol: Added error for blacklisted versions to enhance validation in the smart contract.
IAvalancheL1Middleware.sol: The smart contract was modified to add new error messages, increase validation checks, and introduce a new event for debugging asset class checks.
IRewards.sol: Added new error handling for rewards claiming and distribution, including scenarios where epochs are unfunded, already distributed, or exceed share limits, along with a new event for zero rewards claim attempts.
IVaultTokenized.sol: The smart contract now includes a slash event with collateral redistribution details.
MockAvalancheL1Middleware.sol: The smart contract adds operator management, including enable/disable functions and removal delay, as well as dynamic asset class handling.

🔗 Commit Hash: 6c37d1c

octane-security-app · 2025-06-16T10:35:52Z

Overview

Vulnerabilities found:	1
Severity breakdown:	1 Medium

Detailed findings

`src/contracts/middleware/AvalancheL1Middleware.sol`

Unrestricted Access to calcAndCacheStakes() Cache Values. See more

🔗 Commit Hash: 6c37d1c
🛡️ Octane Dashboard: All vulnerabilities

leopaul36 · 2025-06-20T14:26:41Z

src/contracts/rewards/Rewards.sol

@@ -95,6 +96,8 @@ contract Rewards is AccessControlUpgradeable, IRewards {
        uptimeTracker = UptimeTracker(uptimeTracker_);
        epochDuration = l1Middleware.EPOCH_DURATION();

+        _checkFees(protocolFee_, operatorFee_, curatorFee_);


Maybe redundant with L86-87

leopaul36 · 2025-06-20T14:29:04Z

src/contracts/rewards/Rewards.sol

@@ -136,10 +139,10 @@ contract Rewards is AccessControlUpgradeable, IRewards {

    // Claiming functions
    /// @inheritdoc IRewards
-    function claimRewards(address rewardsToken, address recipient) external {
+    function claimRewards(address rewardsToken, address recipient) external nonReentrant {


Why did all *claim functions became nonReentrant?

gonzaloetjo added 6 commits May 28, 2025 12:13

fix(vaultTokenized.sol): M-01

6b7f870

fix(vaultTokenized.sol): M-02

1dfeec0

fix(vaultFactory.sol): H-01

d3f98b8

fix(delegatorFactory.sol): H-02

292d5b7

fix(Checkpoints.sol): M-03

d198969

fix(AvalancheL1Middleware.sol): C-01

ee2bdd5

gonzaloetjo force-pushed the audit-cyfrin branch from dde0046 to ee2bdd5 Compare June 2, 2025 09:15

gonzaloetjo added 5 commits June 2, 2025 11:39

fix(AvalancheL1Middleware.sol): C-02

32b1a6c

fix(AvalancheL1Middleware.sol): H-04

2a88616

fix(AvalancheL1Middleware.sol): M-04

35f6e56

fix(AvalancheL1Middleware.sol): M-05

f0a6a49

fix(AvalancheL1Middleware.sol): M-06

91ae0e3

gonzaloetjo force-pushed the audit-cyfrin branch from 101551b to 91ae0e3 Compare June 3, 2025 15:22

gonzaloetjo added 3 commits June 4, 2025 14:17

fix(vaultTokenized.sol): M-07

98bd130

fix(Rewards.sol): H-06

8f4adaa

fix(AvalancheL1Middleware.sol): H-07

9bbbcfc

gonzaloetjo force-pushed the audit-cyfrin branch 2 times, most recently from 63674d6 to ce10fda Compare June 10, 2025 10:09

fix(Rewards.sol): H-08

001cf04

gonzaloetjo force-pushed the audit-cyfrin branch from ce10fda to 001cf04 Compare June 11, 2025 07:54

fix(Rewards.sol): H-09

43e09e6

gonzaloetjo force-pushed the audit-cyfrin branch from 68b8241 to 43e09e6 Compare June 11, 2025 14:54

fix(Rewards.sol): H-10

9ac7bf0

gonzaloetjo force-pushed the audit-cyfrin branch 2 times, most recently from 30cf6a4 to fa75a8c Compare June 12, 2025 15:06

leopaul36 reviewed Jun 16, 2025

View reviewed changes

fix(AvalancheL1Middleware): H-03 (H-06)

5157351

gonzaloetjo force-pushed the audit-cyfrin branch from fa75a8c to 5157351 Compare June 16, 2025 09:14

fix(AvalancheL1Middleware): M08 (M12)

dc63daa

gonzaloetjo force-pushed the audit-cyfrin branch from 1e21780 to dc63daa Compare June 16, 2025 10:27

gonzaloetjo force-pushed the audit-cyfrin branch from 9083931 to 1659adb Compare June 16, 2025 13:43

fix(AvalancheL1Middleware): M09 (M14)

ccd5e7d

gonzaloetjo force-pushed the audit-cyfrin branch from 1659adb to 457c1d1 Compare June 16, 2025 14:06

fix(Rewards.sol): M10 (M15)

a5c4913

gonzaloetjo force-pushed the audit-cyfrin branch 4 times, most recently from 50bce4a to becc395 Compare June 18, 2025 13:31

fix(Rewards.sol): H04

6a0cbb1

gonzaloetjo force-pushed the audit-cyfrin branch 2 times, most recently from 4b7b03b to 9891478 Compare June 19, 2025 10:19

fix(Rewards.sol): H07

f9bfdf7

gonzaloetjo force-pushed the audit-cyfrin branch from 9891478 to f9bfdf7 Compare June 19, 2025 13:50

gonzaloetjo added 2 commits June 19, 2025 16:33

fix(Rewards.sol): M11 (M16)

f76d1f4

fix(Rewards.sol): M12 (M17)

6c37d1c

gonzaloetjo force-pushed the audit-cyfrin branch from 7a9764c to 6c37d1c Compare June 19, 2025 15:22

leopaul36 reviewed Jun 20, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Audit cyfrin #155

Audit cyfrin #155

Uh oh!

gonzaloetjo commented May 28, 2025 •

edited

Loading

Uh oh!

leopaul36 Jun 16, 2025

Uh oh!

leopaul36 Jun 16, 2025

Uh oh!

leopaul36 Jun 16, 2025

Uh oh!

leopaul36 Jun 16, 2025

Uh oh!

octane-security-app bot commented Jun 16, 2025 •

edited

Loading

Uh oh!

octane-security-app bot commented Jun 16, 2025 •

edited

Loading

Uh oh!

leopaul36 Jun 20, 2025

Uh oh!

leopaul36 Jun 20, 2025

Uh oh!

Uh oh!

Audit cyfrin #155

Are you sure you want to change the base?

Audit cyfrin #155

Uh oh!

Conversation

gonzaloetjo commented May 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Linked issues

Solved

On-going:

Aknowledged

Changes

Uh oh!

leopaul36 Jun 16, 2025

Choose a reason for hiding this comment

Uh oh!

leopaul36 Jun 16, 2025

Choose a reason for hiding this comment

Uh oh!

leopaul36 Jun 16, 2025

Choose a reason for hiding this comment

Uh oh!

leopaul36 Jun 16, 2025

Choose a reason for hiding this comment

Uh oh!

octane-security-app bot commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by Octane

New Contracts

Updated Contracts

Uh oh!

octane-security-app bot commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overview

Detailed findings

src/contracts/middleware/AvalancheL1Middleware.sol

Uh oh!

leopaul36 Jun 20, 2025

Choose a reason for hiding this comment

Uh oh!

leopaul36 Jun 20, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gonzaloetjo commented May 28, 2025 •

edited

Loading

octane-security-app bot commented Jun 16, 2025 •

edited

Loading

octane-security-app bot commented Jun 16, 2025 •

edited

Loading

`src/contracts/middleware/AvalancheL1Middleware.sol`