<!-- canonical: https://0xsimao.com/reports/clip-finance-strategy-upgrade -->

# Clip Finance Strategy Upgrade audit

Three Sigma · DeFi infrastructure · 15th March 2024

A private security review of Clip Finance (DeFi infrastructure), conducted with Three Sigma and completed on 15th March 2024 over 8 days. 0xSimao disclosed 11 findings: 2 high severity, 1 medium, 7 low and 1 informational.

## What Clip Finance is

Clip Finance routes stablecoin deposits into risk-scored, auto-compounding yield strategies through modular contracts that farm external protocols autonomously and return the profits to depositors.

## Scope

The second Three Sigma review focused on one upgrade: the PCLBaseSwapInside strategy, with the PCLPoolHelper and PHyperLPoolSwapInside pool legs and the storage contract under them, and the swap-inside pricing path as the pressure point.

## Findings

### High

- [In PCLBaseSwapInside::_compoundRewards(), if the sellPortion is smaller than rewardSwapThreshold, some of the rewards will move to keepPortion](https://0xsimao.com/findings/clip-finance-ii-compound-rewards-smaller-reward)
- [PHyperLPoolSwapInside::_rebalance() checks the price manipulation before and after the swap with the same price threshold](https://0xsimao.com/findings/clip-finance-ii-rebalance-price-manipulation-same)

### Medium

- [Compounding shares will overtime get less rewards than non compounding shares](https://0xsimao.com/findings/clip-finance-ii-compounding-shares-overtime-rewards)

### Low

- [InRatioSwap fuzz test shows error up to 1e10 of a token with 18 decimal places](https://0xsimao.com/findings/clip-finance-ii-shows-error-decimal-places)
- [Missing _disableInitializers() call in the constructor](https://0xsimao.com/findings/clip-finance-ii-disable-initializers-call-constructor)
- [Rebalancing back to original lower and upper ticks will not deposit nft to farm](https://0xsimao.com/findings/clip-finance-ii-rebalancing-original-upper-deposit)
- [PHyperLPoolSwapInside::_swapWithCustomData() .approve() reverts for tokens that don't return a boolean](https://0xsimao.com/findings/clip-finance-ii-approve-reverts-return-boolean)
- [PHyperLPoolSwapInside::_swapWithCustomData() checks price manipulation for pool, but the router used may route through another pool](https://0xsimao.com/findings/clip-finance-ii-price-manipulation-route-through)
- [PHyperLPoolSwapInside::_swapWithCustomData() should check if the router has code](https://0xsimao.com/findings/clip-finance-ii-hyper-custom-check-code)
- [Lost NFT if farmingContract is incorrectly set](https://0xsimao.com/findings/clip-finance-ii-lost-farming-contract-incorrectly)

### Informational

- [Unnecessary abi.decode in PHyperLPoolSwapInside::_swapWithCustomData()](https://0xsimao.com/findings/clip-finance-ii-unnecessary-abi-decode-custom)

## The report

[Download the report (PDF)](https://0xsimao.com/reports/2024-03-15-clip-finance-ii.pdf)

[Protocol](https://www.clip.finance/)