Clip Finance Strategies audit
A private security review of Clip Finance (DeFi infrastructure), conducted with Three Sigma and completed on 10th November 2023. 0xSimao disclosed 17 findings: 10 high severity, 5 medium and 2 low.
What Clip Finance is
Clip Finance routes stablecoin deposits into risk-scored, auto-compounding yield strategies through modular contracts, with scheduled withdrawals matching exits against strategy liquidity rather than unwinding positions on the spot.
Scope
The review concentrated on the withdrawal scheduler and the strategy router around it: fulfilment ordering, slippage on exit, deadline handling in the swap legs, and what happens when a strategy saturates or a token becomes unsupported.
High severity findings
- Anyone can grief users, stopping them from fulfilling their withdrawals
- Swapping with deadline as block.timestamp and 0 minimum amount out is vulnerable to MEV
- BatchOut:executeBatchWithdrawFromStrategyWithSwap() gives unfairly different slippage depending on the chosen token
- BatchOut:withdrawFulfill() can be DoSed by spamming withdrawal requests, leading to OOG reverts
- Scheduled withdrawals with unsupported tokens will be halted
- Halted withdrawals in BatchOut due to setting withdrawTo to address(0) in scheduleWithdrawal()
- Yield loss due to StrategyRouterLib:rebalanceStrategies() not allocating saturated strategy deposits
- Halted withdrawals in BatchOut:withdrawFulfill() due to tokens transfer() reverting on 0 transfer amount
- Inconsistent batch:rebalance() behavior when some strategies reach their limit, leading to yield loss
- Tokens with callbacks may allow malicious attackers to steal the protocol
Medium severity findings
- Potential overflow in PancakeSwapPlugin:getRoutePrice()
- DoSed StrategyRouter:withdrawFromStrategies() if strategyTokenBalancesUsd[i] is too small in the swapping phase
- Batch:withdraw() can be DoSed by frontrunning it with strategyRouter:allocateToStrategies()
- StrategyRouterLib.sol bug when subtracting from balance
- Fee on transfer tokens transfer less tokens than what is stored in the receipt on deposits
Low severity findings
- Missing fee refund on Batch.sol
- getDepositFeeInBNB() assumes a stablecoin price of 1 USD, which may not be true if it depegs
The report