# Clip Finance Strategies audit Three Sigma · DeFi infrastructure · 10th November 2023 A private security review of Clip Finance (DeFi infrastructure), conducted with Three Sigma and completed on 10th November 2023. 0xSimao disclosed 17 findings: 10 high severity, 5 medium and 2 low. ## What Clip Finance is Clip Finance routes stablecoin deposits into risk-scored, auto-compounding yield strategies through modular contracts, with scheduled withdrawals matching exits against strategy liquidity rather than unwinding positions on the spot. ## Scope The review concentrated on the withdrawal scheduler and the strategy router around it: fulfilment ordering, slippage on exit, deadline handling in the swap legs, and what happens when a strategy saturates or a token becomes unsupported. ## High severity findings - [Anyone can grief users, stopping them from fulfilling their withdrawals](https://0xsimao.com/findings/clip-finance-i-grief-stopping-fulfilling-withdrawals) - [Swapping with deadline as block.timestamp and 0 minimum amount out is vulnerable to MEV](https://0xsimao.com/findings/clip-finance-i-swapping-deadline-timestamp-mev) - [BatchOut:executeBatchWithdrawFromStrategyWithSwap() gives unfairly different slippage depending on the chosen token](https://0xsimao.com/findings/clip-finance-i-withdraw-unfairly-slippage-depending) - [BatchOut:withdrawFulfill() can be DoSed by spamming withdrawal requests, leading to OOG reverts](https://0xsimao.com/findings/clip-finance-i-withdraw-spamming-withdrawal-reverts) - [Scheduled withdrawals with unsupported tokens will be halted](https://0xsimao.com/findings/clip-finance-i-scheduled-withdrawals-unsupported-halted) - [Halted withdrawals in BatchOut due to setting withdrawTo to address(0) in scheduleWithdrawal()](https://0xsimao.com/findings/clip-finance-i-withdrawals-withdraw-schedule-withdrawal) - [Yield loss due to StrategyRouterLib:rebalanceStrategies() not allocating saturated strategy deposits](https://0xsimao.com/findings/clip-finance-i-yield-allocating-saturated-deposits) - [Halted withdrawals in BatchOut:withdrawFulfill() due to tokens transfer() reverting on 0 transfer amount](https://0xsimao.com/findings/clip-finance-i-halted-withdrawals-withdraw-transfer) - [Inconsistent batch:rebalance() behavior when some strategies reach their limit, leading to yield loss](https://0xsimao.com/findings/clip-finance-i-inconsistent-behavior-reach-yield) - [Tokens with callbacks may allow malicious attackers to steal the protocol](https://0xsimao.com/findings/clip-finance-i-callbacks-malicious-attackers-steal) ## Medium severity findings - [Potential overflow in PancakeSwapPlugin:getRoutePrice()](https://0xsimao.com/findings/clip-finance-i-overflow-pancake-plugin-price) - [DoSed StrategyRouter:withdrawFromStrategies() if strategyTokenBalancesUsd[i] is too small in the swapping phase](https://0xsimao.com/findings/clip-finance-i-withdraw-balances-usd-phase) - [Batch:withdraw() can be DoSed by frontrunning it with strategyRouter:allocateToStrategies()](https://0xsimao.com/findings/clip-finance-i-withdraw-frontrunning-allocate-strategies) - [StrategyRouterLib.sol bug when subtracting from balance](https://0xsimao.com/findings/clip-finance-i-lib-sol-bug-subtracting) - [Fee on transfer tokens transfer less tokens than what is stored in the receipt on deposits](https://0xsimao.com/findings/clip-finance-i-fee-transfer-receipt-deposits) ## Low severity findings - [Missing fee refund on Batch.sol](https://0xsimao.com/findings/clip-finance-i-fee-refund-batch-sol) - [getDepositFeeInBNB() assumes a stablecoin price of 1 USD, which may not be true if it depegs](https://0xsimao.com/findings/clip-finance-i-deposit-fee-price-depegs) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2023-11-10-clip-finance-i.pdf)