Cork Protocol audit contest

A public audit contest on Sherlock (derivatives), completed on 29th August 2024. 0xSimao placed #1. 15 of his findings are published: 10 high severity and 5 medium.

What Cork Protocol is

Cork prices, hedges and trades depeg risk: Depeg Swaps pair a pegged asset (a stablecoin or liquid staking token) with cover against its peg breaking, a peg stability module issues and redeems the pair, and vaults write that cover to earn the premium.

Scope

The core contracts ahead of mainnet: the peg stability module, the Depeg Swap pair and the cover-writing vaults.

High severity findings

• Lack of slippage protection leads to loss of protocol funds
• Users redeeming early will withdraw Ra without decreasing the amount locked, which will lead to stolen funds when withdrawing after expiry
• VaultPoolLib::reserve() will store the Pa not attributed to user withdrawals incorrectly and leave in untracked once it expires again
• FlashSwapRouter::emptyReserve() and FlashSwapROuter::emptyReservePartial() functions return incorrect values
• Incorrect redeemAmount Is Accounted Due To Not Accounting For The Exchange Rate
• Incoming Redemption Assets not being tracked when repurchase is called
• Users will steal excess funds from the Vault due to VaultPoolLib::redeem() not always decreasing self.withdrawalPool.raBalance and self.withdrawalPool.paBalance
• Wrong accounting of locked RA when repurchasing DS+PA with RA
• Admin new issuance or user calling Vault::redeemExpiredLv() after Psm::redeemWithCt() will lead to stuck funds when trying to withdraw
• Attackers will steal the reserve from the Vault by receiving ra in FlashSwapRouter::__swapDsforRa()

Medium severity findings

• Admin will not be able to only pause deposits in the Vault due to incorrect check leading to DoSed withdrawals
• Admin will not be able to upgrade the smart contracts, breaking core functionality and rendering the upgradeable contracts useless
• Withdrawing all lv before expiry will lead to lost funds in the Vault
• Rebasing tokens are not supported contrary to the readme and will lead to loss of funds
• Providing liquidity to the AMM does not check the return value of actually provided tokens leading to locked funds.

The contest

View the contest page