Penetration Test Report (TrailOfBits): CurveDAO

Curve DAO
Security Assessment
July 1 0th 2 020
Prepared For:
Michael Egorov | S wiss Stake
michael@swiss-stake.com
Prepared By:
Josselin Feist | T rail of Bits
josselin@trailofbits.com
Gustavo Grieco | T rail of Bits
gustavo.grieco@trailofbits.com
Michael Colburn | T rail of Bits
michael.colburn@trailofbits.com
Executive Summary
Project Dashboard
Code Maturity Evaluation
Engagement Goals
Coverage
Recommendations Summary
Short term
Long term
Findings Summary
1. LiquidityGauge does not account for VotingEscrow’s balance updates
2. LiquidityGauge does not account for VotingEscrow’s totalSupply updates
3. Early users will have a unfair advantage
4. GaugeController allows for quick vote and withdraw voting strategy
5. Adding the same gauge multiple times will lead to incorrect sum of weights
6. Spam attack would prevent LiquidityGauge’s integral from being updated
7. Minter user can confiscate any user tokens
8. Mint and Burn events cannot be trusted
9. VotingEscrow’s Admin can take whitelisted accounts hostage
10. ERC20CRV is not initiated correctly with large name and symbol
11. Lack of two-step procedure for critical operations is error-prone
12. Lack of value verification on decimals is error-prone
13. Lack of events is error-prone
14. Race condition in removing addresses from whitelist and withdrawing
15. Lack of documentation is error-prone
16. VotingEscrow’s balanceOfAt and totalSupplyAt can return different values for the
same block
17. No incentive to vote early in GaugeController
18. Several loops are not executable due to gas limitation
19. Testing smart contract code in Brownie can be unreliable
20. Aragon’s voting does not follow voting best practices
21. Race condition may result in users earning less interest than expected
A. Vulnerability Classifications
B. Code Maturity Classifications
C. Code Quality
© 2020 Trail of Bits Curve DAO Assessment | 1
D. Token Integration Checklist
ERC Conformity
Contract Composition
Owner privileges
Token Scarcity
E. Fix Log
Detailed Fix Log
© 2020 Trail of Bits Curve DAO Assessment | 2
Executive Summary
From June 22 through July 10, 2020, Swiss-Stake engaged Trail of Bits to review the security
of Curve DAO. We conducted this assessment over the course of six person-weeks with
three engineers working from f 1c8f43 from the c urve-dao-contracts repository.
In the first two weeks, we focused on understanding the codebase and reviewing the
contracts against the most common smart contract flaws. In the final week, we reviewed
the checkpoint functions and L iquidityGauge bookkeeping, and looked for corner cases in
the most complex contract’s interactions.
Our review resulted in 21 findings ranging from high to informational severity. The most
significant findings are related to incorrect updating of the L iquidityGauge bonus, which
can allow attackers to earn unfair interest. Moreover, we found that the code would benefit
from better documentation, function composition, and code readability. We also found
potential risks related to out-of-gas consumption, and external risk introduced by the use
of Aragon's contracts. See additional code quality issues in A ppendix C, and see
recommendations to follow when adding arbitrary tokens in A ppendix D.
Overall, the codebase meets most of its security expectations. A significant effort has been
made to identify potential risks and to develop suitable mitigations and tests. However, the
codebase is very complex, numerous behaviors are not documented, and the arithmetic
operations would benefit from high-level clarifications.
Moving forward, Trail of Bits recommends addressing the findings presented and
increasing the documentation. Curve Dao must be careful with the deployment of the
contracts and the interactions of its early users and their advantages. We also recommend
considering an alternative to the Aragon voting contract. Finally, we recommend
performing an economic assessment to make sure the monetary incentives are properly
designed.
© 2020 Trail of Bits Curve DAO Assessment | 3
Project Dashboard
Application Summary
Name Curve Dao
Version f1c8f43
Type Vyper contracts
Platforms Ethereum
Engagement Summary
Dates June 22–July 10
Method Whitebox
Consultants Engaged 3
Level of Effort 6 person-weeks
Vulnerability Summary
Total High-Severity Issues 4 ◼◼◼◼
Total Medium-Severity Issues 8 ◼◼◼◼◼◼◼◼
Total Low-Severity Issues 4 ◼◼◼◼
Total Informational-Severity Issues 4 ◼◼◼◼
Total Undetermined-Severity Issues 1 ◼
Total 21
Category Breakdown
◼◼
Access Controls 2
◼◼◼
Auditing and Logging 3
◼◼◼◼◼◼◼◼◼◼◼◼
Data Validation 13
◼
◼
Patching 1
◼◼
Timing 2
Total 21
© 2020 Trail of Bits Curve DAO Assessment | 4
Code Maturity Evaluation
Category Name Description
Access Controls Satisfactory. The codebase has a strong access control
mechanism and we found only minor concerns.
Arithmetic Moderate. T he system relies on complex arithmetic. While the
use of Vyper prevents overflow and underflow flaws, we found
several issues related to interest computation.
Centralization Moderate. T he contracts’ owners have significant privileges.
Additionally, the deployer of E RC20CRV will own all the tokens
at deployment and will have a significant advantage.
Upgradeability Not Applicable.
Function Composition Moderate. Some components are written multiple times, and
the codebase would benefit from greater code reuse.
Front-Running Satisfactory. M ost functions are not impacted by
front-running, or the impact is expected. We found only one
minor issue.
Monitoring Weak. W e found that Mint and Burn events could be
compromised. Additionally, several components do not emit
events. Finally, we were not aware of any off-chain
components that monitor the contracts.
Specification Moderate. The provided documentation omitted several
behaviors, and the codebase would benefit from more
thorough documentation.
Testing & Verification Moderate. The codebase has several unit tests, but it is
missing gas evaluation. No verification of code was present.
© 2020 Trail of Bits Curve DAO Assessment | 5
Engagement Goals
The engagement was scoped to provide a security assessment of Curve DAO protocol
smart contracts in the c urve-dao-contracts repository.
Specifically, we sought to answer the following questions:
● Are appropriate access controls set for the admin/user roles?
● Does arithmetic for internal bookkeeping operations hold?
● Is there any arithmetic overflow or underflow affecting the code?
● Can participants manipulate or block gauge or voting operations?
● Is it possible to manipulate gauges or voting by front-running transactions?
● Is it possible for participants to steal or lose tokens?
● Can participants perform denial-of-service attacks against any of the gauges or
voting escrow?
© 2020 Trail of Bits Curve DAO Assessment | 6
Coverage
The engagement focused on the following components:
● Liquidity gauges: These allow users to deposit liquidity using different ERC20
tokens and get CRV tokens based on the amount locked and other factors. We
reviewed the contract's interactions with users depositing liquidity to ensure proper
behavior. We looked for flaws that would allow an attacker to withdraw more than
deposited and prevent users from withdrawing their assets. We also focused on
interest rate computation and history catch-up.
● Controller gauge: L iquidity gauges are created and managed by a special contract
called the controller gauge. We reviewed the access control of this contract as well
as interaction with the gauges once deployed. We looked for flaws in voting and
checked for the proper increase of period and epoch.
● Voting escrow: O nce users deposit liquidity, they can use mint tokens locked for a
period of time in the voting escrow contract. We reviewed the consistency and the
corner cases in computation of weights and verified that the locks are held in each
case. We looked for flaws that would allow an attacker to unlock a deposit early,
withdraw more than deposited, or prevent users from withdra