- Hacken
- Audits
- blueberry-garden
- [SCA] Composable Corp | Lending Platform | Apr2023
Audit name:
[SCA] Composable Corp | Lending Platform | Apr2023
Date:
Apr 26, 2023
Table of Content
Introduction
We express our gratitude to the Blueberry Garden team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.
Blueberry is a fully decentralized, permissionless marketplace for lending and leveraged borrowing.
| title | content |
|---|---|
| Platform | Ethereum |
| Language | Solidity |
| Timeline | 01/04/2023 - 25/04/2023 |
| Methodology | https://hackenio.cc/sc_methodology→ |
Type: Lending & Leverage Farming Platform
Review Scope | |
|---|---|
| Repository | https://github.com/Blueberryfi/blueberry-core→ |
| Commit | 13040356e26a0405f26b67ecc4b63c1631411ebe |
Review Scope
- Commit
- 13040356e26a0405f26b67ecc4b63c1631411ebe
Audit Summary
10/10
89.39%
8/10
10/10
The system users should acknowledge all the risks summed up in the risks section of the report
Document Information
This report may contain confidential information about IT systems and the intellectual property of the Customer, as well as information about potential vulnerabilities and methods of their exploitation.
The report can be disclosed publicly after prior consent by another Party. Any subsequent publication of this report shall be without mandatory consent.
Document | |
|---|---|
| Name | Smart Contract Code Review and Security Analysis Report for Blueberry Garden |
| Audited By | Hacken |
| Website | https://blueberry.garden/→ |
| Changelog | 07/04/2023 – Initial Review |
| 25/04/2023 – Second Review |
Document
- Name
- Smart Contract Code Review and Security Analysis Report for Blueberry Garden
- Audited By
- Hacken
- Website
- https://blueberry.garden/→
- Changelog
- 07/04/2023 – Initial Review
- 25/04/2023 – Second Review
System Overview
Blueberry Bank is a leveraged yield-farming platform. It consists of:
BlueBerryBank — the main system contract, which supports borrowing, lending, and repaying debts according to a selected strategy.
WERC20 — an ERC1155 wrapper of ERC20 tokens.
WIchiFarm — a wrapper of the ICHI liquidity management protocol.
HardVault — an ERC1155 contract which represents the deposits as an ERC1155 collection.
SoftVault — an ERC20 token contract that represents the number of tokens lent to the Blueberry Money Market.
Spell contracts — strategy contracts that support undersecure borrowed funds to be used for leverage farming.
Oracles — contracts to manage trusted data sources and allow retrieval of token prices.
Privileged roles
\-FeeManager, HardVault, SoftVault, WERC20, WIchiFarm, BlueBerryBank, ProtocolConfig, IchiSpell, CoreOracle
Admin (owner) can:
upgrade the contract logic.
\-BlueBerryBank
Admin (owner) can:
allow or disallow taking/repaying loans.
allow or disallow lending/withdrawing isolated collateral.
whitelist a spell contract.
whitelist tokens.
whitelist ERC1155 tokens.
allow or disallow contract calls.
EOA or Whitelisted contract can:
create a position and interact with the contract.
\-ProtocolConfig
Admin (owner) can:
set all the fee values.
set fee manager, treasury, pool, and vault addresses.
\-IchiSpell
Admin (owner) can:
add strategies.
set “max position size”.
set “max loan to value” for different strategies and tokens.
\-Oracle
Admin (owner) can:
pause and unpause CoreOracle.
set Oracle routes, refs, data feeds, and time gaps.
Executive Summary
Documentation quality
The total Documentation quality score is 10 out of 10.
Functional requirements are sufficient.
Technical description is provided.
Code quality
The total Code quality score is 8 out of 10.
The code is designed in a way to do recursive contract calls BlueBerryBank -> Spell -> BlueBerryBank.
The code is missing initialization of
PausableUpgradeable.The code is missing events for such actions as Spell whitelist or permitting interactions by smart contracts.
The code performs calls to the ERC20-approve function without checking the return value.
The code highly trusts vaults, tokens, etc. However, all the interacted systems are whitelisted by the system owners.
The development environment is configured.
Test coverage
Code coverage of the project is 89.39% (branch coverage).
Security score
Upon auditing, the code was found to contain 0 critical, 2 high, 12 medium, and 20 low severity issues. Out of these, 29 issues have been addressed and resolved, leading to a security score of 10 out of 10.
All identified issues are detailed in the “Findings” section of this report.
Summary
The comprehensive audit of the customer's smart contract yields an overall score of 9.2. This score reflects the combined evaluation of documentation, code quality, test coverage, and security aspects of the project.
Risks
The system highly relies on the Blueberry Money Market and ICHI Farm functionality which is out of the audit scope. The mentioned systems receive access to user funds.
The system uses prices received from Band Protocol, Chainlink, Uniswap (at previous blocks), and possibly other sources. The data providers may affect user position states. Check if the sources are stable and do not have disclosed vulnerabilities.
IchiVaultOracle highly relies on IchiVault. In case the IchiVault reserves could be manipulated, the resulting price may be affected and some positions become at risk of liquidation. It is recommended to check that the used IchiVault instances do not have disclosed vulnerabilities and could not be significantly affected by any third party.
The AggregatorOracle contract receives data from several sources and checks if the deviation of the price is within bounds. However, in case only one source responds with a price, that value is used. In case some of the sources are unstable or vulnerable, an attacker may manipulate the resulting price. It is recommended to ensure that the contract relies on stable data providers.
According to the documentation, only the CoreOracle contract should be used for providing prices to the target contracts (BlueberryBank, IchiSpell, etc.). In case another oracle is used, important price validations may be missed.
The oracles highly depend on the owner. The owner is able to manipulate token prices received by the project.
The Admin of BlueBerryBank may disable/enable actions for users at any time: lend, withdraw, repay, borrow.
The Admin of BlueBerryBank may de-whitelist previously whitelisted tokens and spells.
The system may be vulnerable to uncommon ERC20 tokens such as tokens with floating decimals (and 19+ decimals), fee-on-transfer tokens, or tokens with a non-failing approve function implemented (which in case of error returns false instead of reverting the transaction).
The IchiSpell contract allows the Admin to add strategies with custom vault addresses. The pool address received from the vault contract is able to drain any allowances to the IchiSpell contract.
In case repaying is not enabled on the contract, it is impossible to liquidate risky positions. Users and the platform may lose their assets or funds value.
In case of high borrowing interest rates, it may be impossible to withdraw lent funds and collaterals until someone’s debt is not repaid.
The Admin of BlueBerryBank may change the maximum “loan to value” proportion for any collateral at any time.
Findings
Code ― | Title | Status | Severity | |
|---|---|---|---|---|
| F-2023-1604 | Invalid Calculations — Collateral Value Corruption | fixed | High | |
| F-2023-1603 | Upgradeability Issues — Missing Storage Gap | fixed | High | |
| F-2023-1616 | Best Practice Violation — Unpausable Oracles | fixed | Medium | |
| F-2023-161 | Best Practice Violation — Denial of Service | fixed | Medium | |
| F-2023-161 | Contradiction — Unvalidated TWAP Period | fixed | Medium | |
| F-2023-161 | Contradiction — Unchecked Relyment | fixed | Medium | |
| F-2023-161 | Contradiction — Unchecked Relyment | fixed | Medium | |
| F-2023-161 | Contradiction — Unvalidated TWAP Period | fixed | Medium | |
| F-2023-161 | Contradiction — Unchecked Relyment | fixed | Medium | |
| F-2023-160 | Contradiction — Requirement Violation | fixed | Medium |
Appendix 1. Severity Definitions
When auditing smart contracts, Hacken is using a risk-based approach that considers Likelihood, Impact, Exploitability and Complexity metrics to evaluate findings and score severities.
Reference on how risk scoring is done is available through the repository in our Github organization:
Severity | Description |
|---|---|
Critical | Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation. |
High | High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation. |
Medium | Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category. |
Low | Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score. |
Severity
- Critical
Description
- Critical vulnerabilities are usually straightforward to exploit and can lead to the loss of user funds or contract state manipulation.
Severity
- High
Description
- High vulnerabilities are usually harder to exploit, requiring specific conditions, or have a more limited scope, but can still lead to the loss of user funds or contract state manipulation.
Severity
- Medium
Description
- Medium vulnerabilities are usually limited to state manipulations and, in most cases, cannot lead to asset loss. Contradictions and requirements violations. Major deviations from best practices are also in this category.
Severity
- Low
Description
- Major deviations from best practices or major Gas inefficiency. These issues will not have a significant impact on code execution, do not affect security score but can affect code quality score.
Appendix 2. Scope
The scope of the project includes the following smart contracts from the provided repository:
Scope Details | |
|---|---|
| Repository | https://github.com/Blueberryfi/blueberry-core→ |
| Commit | 13040356e26a0405f26b67ecc4b63c1631411ebe |
| Whitepaper | Not provided |
| Requirements | Public Gitbook→ |
| Technical Requirements | Essential Scripts→ |
Scope Details
- Commit
- 13040356e26a0405f26b67ecc4b63c1631411ebe
- Whitepaper
- Not provided
- Requirements
- Public Gitbook→
- Technical Requirements
- Essential Scripts→