Rebalance

We express our gratitude to the Rebalance team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

The Rebalance Lending System is a set of smart contracts designed for managing and generating yield on assets deposited by users. It provides a vault-like structure where users can deposit assets, receive tokenized shares representing their stake, and earn interest from various yield-generating providers.

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

• Functional requirements are missed.

• Technical description is not provided.

Code quality

• Some of the best practices are missing.

Test coverage

Code coverage of the project is 90.96% (branch coverage),.

• Not all branches are covered with tests.

The Rebalance Lending System is a set of smart contracts designed for managing and generating yield on assets deposited by users. It provides a vault-like structure where users can deposit assets, receive tokenized shares representing their stake, and earn interest from various yield-generating providers. The system also includes functionality for locking tokens, managing vaults, and interacting with yield providers.

Contracts

InterestVaultV1

• Definition: An abstract ERC4626-compliant vault contract defining common functions and interfaces for all vault types.

• Functions:

• • deposit, mint, withdraw, redeem: Basic ERC4626 functions for managing user deposits and withdrawals.

  • initializeVaultShares: Initializes vault shares with a specified amount of assets.

  • setActiveProvider, setDepositLimits, setTreasury, setWithdrawFee, setMinAmount: Admin functions for setting various parameters.

  • rebalance: Rebalances assets across providers.

• Attributes:

• • _asset: The main ERC20 asset managed by this vault.

  • _underlyingDecimals: Decimals of the underlying asset.

  • _providers: Array of yield providers.

  • activeProvider: Currently active provider for yield generation.

  • minAmount, vaultDepositLimit, userDepositLimit, withdrawFeePercent, treasury: Configuration parameters for deposits and withdrawals.

  • initialized: Boolean indicating if the vault has been initialized.

• Privileged Roles:

• • DEFAULT_ADMIN_ROLE: Full administrative access.

  • REBALANCER_ROLE: Role allowed to perform rebalancing operations.

InterestLocker

• Definition: A contract to lock and unlock ERC20 tokens, intended for locking rebalancer tokens.

• Functions:

• • lockTokens: Allows users to lock tokens for a specified duration.

  • unlockTokens: Allows users to unlock tokens after the lock duration has passed.

  • setTokens: Admin function to set supported tokens.

• Attributes:

• • MIN_DURATION: Minimum duration for locking tokens (30 days).

  • nextLockId: Incremental ID for tracking locks.

  • _tokens: Array of supported tokens.

  • lockInfo: Mapping of lock ID to lock information.

  • _beneficiaries: Mapping of lock ID to beneficiary address.

  • _totalLocked: Mapping of token address to total locked amount.

• Privileged Roles:

• • owner: Only the contract owner can set supported tokens.

VaultManager

• Definition: Manages the rebalancing of vaults.

• Functions:

• • rebalanceVault: Rebalances assets across providers within a vault.

• Privileged Roles:

• • DEFAULT_ADMIN_ROLE: Full administrative access.

  • EXECUTOR_ROLE: Role allowed to execute rebalancing operations.

VaultRebalancerV1

• Definition: An implementation vault that handles pooled single-sided asset lending strategies for yield generation.

• Functions:

• • rebalance: Rebalances assets across providers.

• Attributes:

• • Inherits attributes and functions from InterestVaultV1.

Attributes

• Tokens:

• • name: The name of the token-shares managed in the vault.

  • symbol: The symbol of the token-shares managed in the vault.

  • decimals: The number of decimals used to get user representation.

  • totalSupply: The total supply of token-shares in the vault.

  • balanceOf: The balance of token-shares held by a user.

• Providers: Various yield-generating providers like AaveV3Arbitrum.

• • Functions to interact with providers include deposit, withdraw, getDepositBalance, getDepositRateFor, getOperator, and getProviderName.

Privileged Roles

• DEFAULT_ADMIN_ROLE: Complete control over the system, including setting active providers, deposit limits, treasury, and withdrawal fees.

• REBALANCER_ROLE: Authorized to perform rebalancing of assets across providers.

• EXECUTOR_ROLE: Allowed to execute rebalancing operations.

• Owner: In InterestLocker, the owner can set supported tokens for locking.

This structured system ensures secure and efficient management of user deposits, yield generation through multiple providers, and controlled access for administrative tasks.

The scope of the project includes the following smart contracts from the provided repository:

Contracts in Scope