Shuttle Labs

We express our gratitude to the Shuttle Labs team for the collaborative engagement that enabled the execution of this Smart Contract Security Assessment.

Shuttle Labs is multi-chain decentralized exchange that utilizes Lit Protocol to enable \<10 second cross chain swaps.

The system users should acknowledge all the risks summed up in the risks section of the report

Documentation quality

• Functional requirements are partially provided.

• Technical description is not provided.

Code quality

• The code contains some gas-inefficient usages.

• The development environment is configured.

Test coverage

Code coverage could not measured due to an error occurred when running “forge coverage” command.

Shuttle Labs is a bridge solution with the following contracts:

GeniusGasTank — a contract that facilitates gasless sponsored transactions by leveraging Permit2 functionality for token approvals, batching transactions, and executing them via a proxy.

GeniusVaultCore — a contract that provides cross-chain liquidity management and swaps by utilizing stablecoins as the primary asset, ensuring efficient asset handling and order processing. It incorporates staking, order creation, and liquidity rebalancing mechanisms.

GeniusRouter — a contract that enables transaction aggregation by handling token approvals, transfers, and calls to external contracts through Permit2 and a proxy. It facilitates operations like swaps, order creation, and cross-chain transactions by interacting with GeniusVault and other contracts.

GeniusActions  — a contract that manages actions within the Genius Protocol by enabling their addition, removal, and modification.

GeniusVault  —  a contract that acts as a cross-chain stablecoin bridge with integrated price-based deposit protection, ensuring secure handling of stablecoin transactions. It leverages Chainlink price feeds to safeguard against stablecoin depegging and includes features for fee collection, order creation, and liquidity management.

GeniusProxyCall  — a contract that allows for aggregating and executing multiple operations, including token approvals, transfers, and calls to other contracts, in a single transaction.

MultiSendCallOnly  — contract is a utility that allows batching multiple transactions into a single execution, where each transaction is a call operation (direct external function call with optional value transfer).

GeniusErrors  — a library that defines a comprehensive set of custom error types for use within the Genius protocol.

Privileged roles

• The admin of the GeniusActions contract can;

• • set the orchestrators

  • set the commit hash

  • add a new action

  • update an action's status

  • update an action's IPFS hash

• The Sentinel role of the GeniusActions contract can;

• • disable an action

  • disable an orchestrator

• The admin of the GeniusGasTank contract can;

• • set the fee recipient

  • set the proxy call contract

  • unpause the contract

• The admin or orchestrator role of GeniusVault contract can;

• • claim fees

• The admin  role of GeniusVaultCore contract can;

• • set rebalance threshold

  • set the proxy call contract

  • unpause the contract

  • set the price feed address

  • set target chain minimum fee amount

  • set stable coin price boundaries

  • set max order amount

• The orchestrator role of GeniusVaultCore contract can;

• • set rebalance threshold

  • cancel an order

Appendix Scope

The scope of the project includes the following smart contracts from the provided repository:

Assets in Scope