Clip Finance Strategy Upgrade audit
A private security review of Clip Finance (DeFi infrastructure), conducted with Three Sigma and completed on 15th March 2024 over 8 days. 0xSimao disclosed 11 findings: 2 high severity, 1 medium, 7 low and 1 informational.
What Clip Finance is
Clip Finance routes stablecoin deposits into risk-scored, auto-compounding yield strategies through modular contracts that farm external protocols autonomously and return the profits to depositors.
Scope
The second Three Sigma review focused on one upgrade: the PCLBaseSwapInside strategy, with the PCLPoolHelper and PHyperLPoolSwapInside pool legs and the storage contract under them, and the swap-inside pricing path as the pressure point.
High severity findings
- In PCLBaseSwapInside::_compoundRewards(), if the sellPortion is smaller than rewardSwapThreshold, some of the rewards will move to keepPortion
- PHyperLPoolSwapInside::_rebalance() checks the price manipulation before and after the swap with the same price threshold
Medium severity findings
Low severity findings
- InRatioSwap fuzz test shows error up to 1e10 of a token with 18 decimal places
- Missing _disableInitializers() call in the constructor
- Rebalancing back to original lower and upper ticks will not deposit nft to farm
- PHyperLPoolSwapInside::_swapWithCustomData() .approve() reverts for tokens that don't return a boolean
- PHyperLPoolSwapInside::_swapWithCustomData() checks price manipulation for pool, but the router used may route through another pool
- PHyperLPoolSwapInside::_swapWithCustomData() should check if the router has code
- Lost NFT if farmingContract is incorrectly set
Informational findings
The report