Penetration Test Report (TrailOfBits): YieldProtocol

Yield Protocol
Security Assessment
August 21, 2020
Prepared For:
Allan Niemerg | Y​ ield
allan@yield.is
Prepared By:
Gustavo Grieco | T​ rail of Bits
gustavo.grieco@trailofbits.com
Michael Colburn | T​ rail of Bits
michael.colburn@trailofbits.com
Executive Summary
Project Dashboard
Code Maturity Evaluation
Engagement Goals
Coverage
Automated Testing and Verification
System properties
General properties
ABDK arithmetic properties
YieldMath properties
Recommendations Summary
Short term
Long term
Findings Summary
1. Flash minting can be used to redeem fyDAI
2. Permission-granting is too simplistic and not flexible enough
3. pot.chi() value is never updated
4. Lack of validation when setting the maturity value
5. Delegates can be added or removed repeatedly to bloat logs
6. Withdrawing from the Controller allows accounts to contain dust
7. Solidity compiler optimizations can be dangerous
8. Lack of chainID validation allows signatures to be re-used across forks
9. Permit opens the door for griefing contracts that interact with the Yield Protocol
10. Pool initialization is unprotected
11. Computation of DAI/fyDAI to buy/sell is imprecise
A. Vulnerability Classifications
B. Code Maturity Classifications
C. Code Quality Recommendations
General
Controller
Liquidations
D. Fix Log
Detailed fix log
© 2020 Trail of Bits Yield Protocol Assessment | 1
Executive Summary
From August 3 through August 21, 2020, Yield engaged Trail of Bits to review the security of
the Yield Protocol. Trail of Bits conducted this assessment over the course of six
person-weeks with two engineers working from commit hash ​4422fda from the
​
yieldprotocol/fyDai repository.
​
Week one: ​We familiarized ourselves with the codebase and whitepapers. We also began
checking for common Solidity flaws and identifying areas that would benefit from
tool-assisted analysis.
Week two: ​We continued manual review of the various Yield Protocol contracts, focusing
on interactions between the different contracts as well as with the external MakerDAO
system. We also began to develop properties for Echidna.
Final week: A​ s we concluded our manual review, we focused on the custom arithmetic
libraries, the Pool market maker, and Unwind contracts, and finalized the set of properties
that were tested.
Our review resulted in 11 findings ranging from high to informational severity.
Interestingly, the issues we found do not have any particularity in common: They affect a
variety of different areas, but most of them allow us to break some internal invariants, e.g.,
the redemption of more ​fyDAI tokens than expected (​TOB-YP-001​), the use of invalid
​
maturity values (​TOB-YP-004)​ , or only dust amounts of assets remaining in the controller
accounts (​TOB-YP-006​). We also make several code quality recommendations in A​ ppendix
C​.
During the assessment, Yield provided fixes for issues when possible. Trail of Bits verified
the fixes for ​TOB-YP-002,​ ​TOB-YP-005,​ and ​TOB-YP-006​, as well as a partial fix for
TOB-YP-001​.
Overall, the code follows a high-quality software development standard and best practices.
It has suitable architecture and is properly documented. The interactions between
components are well-defined. The functions are small, with a clear purpose.
Trail of Bits recommends addressing the findings presented and integrating the
property-based testing into the codebase. Yield must be careful with the deployment of the
contracts and the interactions of its early users and their advantages. Finally, we
recommend performing an economic assessment to make sure the monetary incentives
are properly designed.
© 2020 Trail of Bits Yield Protocol Assessment | 2
Update: On September 14, 2020, Trail of Bits reviewed fixes proposed by Yield for the issues
presented in this report. See a detailed review of the current status of each issue in ​Appendix D.​
The name of the yDAI token was changed to fyDAI subsequent to our assessment but prior to the
finalization of this report. The report has been modified such that all references to the “yDAI”
token were replaced with “fyDAI”. However, all references to source code artifacts (e.g., smart
contract names such as YDai) remain as they were in the assessed version of the codebase.
© 2020 Trail of Bits Yield Protocol Assessment | 3
Project Dashboard
Application Summary
Name Yield Protocol
Version 4422fda
Type Solidity
Platforms Ethereum
Engagement Summary
Dates August 3–August 21, 2020
Method Whitebox
Consultants Engaged 2
Level of Effort 6 person-weeks
Vulnerability Summary
Total High-Severity Issues 1 ◼
Total Medium-Severity Issues 1 ◼
Total Low-Severity Issues 5 ◼◼◼◼◼
Total Informational-Severity Issues 2 ◼◼
Total Undetermined-Severity Issues 2 ◼◼
Total 11
Category Breakdown
Undefined Behavior 2 ◼◼
Access Controls 3 ◼◼◼
Data Validation 4 ◼◼◼◼
Auditing and Logging 1 ◼
Timing 1 ◼
Total 11
© 2020 Trail of Bits Yield Protocol Assessment | 4
Code Maturity Evaluation
In the table below, we review the maturity of the codebase and the likelihood of future
issues. In each area of control, we rate the maturity from strong to weak, or missing, and
give a brief explanation of our reasoning.
Category Name Description
Access Controls Satisfactory. ​Appropriate access controls were in place for
performing privileged operations.
Arithmetic Satisfactory. ​The contracts included use of safe arithmetic and
casting functions. No potential overflows were possible in areas
where these functions were not used.
Assembly Use Strong.​ The contracts only used assembly to fetch the ​chainID for
​
ERC2612 ​permit functionality.
​
Centralization Satisfactory. W​ hile the protocol relied on an owner to correctly
deploy the initial contracts, ownership could be renounced later and
users would verify this using on-chain events.
Contract Not Applicable. ​The contracts contained no upgradeability
Upgradeability mechanisms.
Function Strong.​ Functions and contracts were organized and scoped
Composition appropriately.
Front-Running Satisfactory. ​Although some functionality could have been affected
by front-running attacks, the impact was low.
Monitoring Satisfactory. T​ he events produced by the smart contract code were
sufficient to monitor on-chain activity.
Specification Satisfactory. ​White papers describing the functionality of the
protocol and accompanying pool were available. The contract source
code included NatSpec comments for all contracts and functions.
Testing & Moderate. ​While the contracts included a large number of unit tests,
Verification the testing did not include any use of automatic tools such as
fuzzers.
© 2020 Trail of Bits Yield Protocol Assessment | 5
Engagement Goals
The engagement was scoped to provide a security assessment of Yield Protocol smart
contracts in the y​ ieldprotocol/fyDAI repository.
​
Specifically, we sought to answer the following questions:
● Are appropriate access controls set for the user and the smart contract interactions?
● Does arithmetic regarding token minting, burning, and pool operations hold?
● Is there any arithmetic overflow or underflow affecting the code?
● Can participants manipulate or block tokens or pool operations?
● Is it possible to manipulate the pools by front-running transactions?
● Is it possible for participants to steal or lose tokens?
● Can participants perform denial-of-service or phishing attacks against any of the
components?
Coverage
Controller.​ The Controller contract contains the main business logic and acts as the entry
point for users within the Yield Protocol. It allows users to manage collateral and debt
levels. We manually reviewed the contract's interactions with the MakerDAO system to
ensure proper behavior. We also used property-based testing tools to make sure its
invariants held and users were able to perform operations with the contract without
unexpected reverts.
YDai. T​ he​ ​YDai contract implements an ERC20 token that allows a user to mint tokens by
​ ​
locking up their ​Dai until a fixed maturity date.