# Fuji Finance audit Three Sigma · Lending aggregator · 6th May 2023 A private security review of Fuji Finance (lending aggregator), conducted with Three Sigma and completed on 6th May 2023. 0xSimao disclosed 46 findings: 12 high severity, 7 medium, 8 low and 19 informational. ## What Fuji Finance is Fuji aggregates DeFi money markets: user loan requests route to the venue with the best rate, open positions refinance automatically as rates move, and Connext-style bridges let collateral sit on one chain while the loan disburses on another, all in single transactions. ## Scope The Three Sigma review covered the vault and rebalancer core: flash-loan-driven refinancing between providers, the router's handler permissions, preview/transformation maths for mint and debt, and approval handling across providers. ## High severity findings - [In BaseRouter, the beneficiary isn't checked when starting a flashloan action and it replaces the previous beneficiary](https://0xsimao.com/findings/fuji-finance-beneficiary-starting-flashloan-replaces) - [Wrong tokensToCheck logic in BaseRouter enables attackers to steal funds](https://0xsimao.com/findings/fuji-finance-logic-enables-attackers-steal) - [Changing providers might lead to lost assets in BorrowingVault and YieldVault](https://0xsimao.com/findings/fuji-finance-changing-providers-lost-yield) - [REBALANCER_ROLE can drain funds by rebalancing in a loop in the BorrowingVault](https://0xsimao.com/findings/fuji-finance-rebalancer-drain-rebalancing-loop) - [UniswapV2Swapper uses block.timestamp for deadline [Out of scope]](https://0xsimao.com/findings/fuji-finance-uniswap-timestamp-deadline-scope) - [ConnextHandler executeFailedWithUpdatedArgs(...) reentrancy allowedCaller can steal all ConnextHandler tokens](https://0xsimao.com/findings/fuji-finance-handler-reentrancy-caller-steal) - [Wrong transformation in function previewMintDebt(...)](https://0xsimao.com/findings/fuji-finance-transformation-preview-mint-debt) - [safeApprove(...) reverts if approval is different than 0, use safeIncreaseAllowance(...) instead](https://0xsimao.com/findings/fuji-finance-approve-reverts-approval-allowance) - [Attackers can claim deposits to vaults if users specify the router as receiver and don't withdraw shares after](https://0xsimao.com/findings/fuji-finance-deposits-specify-withdraw-shares) - [BorrowingVault, if the debt/assets ratio falls too much, liquidators could choose to repay debt equal to the assets at a discount](https://0xsimao.com/findings/fuji-finance-debt-falls-choose-repay) - [ConnextRouter fails to record failed message if gas sent is not enough](https://0xsimao.com/findings/fuji-finance-fails-record-message-gas) - [Users can claim tokens in ConnextRouter by calling xReceive(...) directly](https://0xsimao.com/findings/fuji-finance-claim-connext-calling-directly) ## Medium severity findings - [Payback can be DoSed in the BorrowingVault, may be profitable for liquidators](https://0xsimao.com/findings/fuji-finance-payback-borrowing-profitable-liquidators) - [Approval in BaseVault reduces over time](https://0xsimao.com/findings/fuji-finance-approval-base-reduces-time) - [BaseFlasher transfers tokens and then calls xBundle(...), so the sent tokens can't be returned due to the balance check](https://0xsimao.com/findings/fuji-finance-flasher-transfers-bundle-returned) - [_crossTransfer(...) reverts for smart contracts that don't share the same address on different chains](https://0xsimao.com/findings/fuji-finance-cross-transfer-reverts-share) - [It's impossible to do a depositETH action on xReceive(...) in ConnextRouter](https://0xsimao.com/findings/fuji-finance-impossible-deposit-eth-action) - [Connext delegates can perform important actions, make sure smart contract users implement them](https://0xsimao.com/findings/fuji-finance-perform-important-actions-sure) - [Withdraw and borrow can be DoSed in BaseRouter](https://0xsimao.com/findings/fuji-finance-withdraw-borrow-sed-base) ## Low severity findings - [Handling someone else repaying debt for the BorrowingVault could be done differently](https://0xsimao.com/findings/fuji-finance-handling-someone-debt-differently) - [BaseVault is not fully ERC5143 compliant](https://0xsimao.com/findings/fuji-finance-base-fully-erc5143-compliant) - [In BaseRouter, _handleSwapAction(...), users shouldn't be allowed to send funds to an allowed flasher](https://0xsimao.com/findings/fuji-finance-handle-action-shouldn-flasher) - [BaseRouter, _bundleInternal(...) Action.Flashloan does not check if the selector matches xBundle(...)](https://0xsimao.com/findings/fuji-finance-bundle-internal-flashloan-matches) - [_crossTransfer(...) should revert if users specify routerByDomain[destDomain] as destination](https://0xsimao.com/findings/fuji-finance-transfer-revert-specify-dest) - [executeFailedWithUpdatedArgs(...) shouldn't be able to change beneficiary](https://0xsimao.com/findings/fuji-finance-args-shouldn-change-beneficiary) - [When changing addresses, use 2 step transfer and/or contract size and/or address 0x0 checks](https://0xsimao.com/findings/fuji-finance-changing-addresses-transfer-0x0) - [_getBeneficiaryFromCalldata(...) in ConnextRouter should not allow the first action to be depositETH(...)](https://0xsimao.com/findings/fuji-finance-beneficiary-calldata-deposit-eth) ## Informational findings - [Borrowing is not vulnerable to an inflation attack, it's unnecessary to borrow when initializing the vault](https://0xsimao.com/findings/fuji-finance-inflation-attack-borrow-initializing) - [YieldVault maxRedeem(...) unnecessarily converts shares to assets and back to shares again](https://0xsimao.com/findings/fuji-finance-yield-redeem-converts-shares) - [Throughout code base, implement using SafeERC20 for IERC20 for better readability](https://0xsimao.com/findings/fuji-finance-erc20-ierc20-better-readability) - [BaseFlasher does extra abi.encode unnecessarily](https://0xsimao.com/findings/fuji-finance-flasher-abi-encode-unnecessarily) - [ConnextHandler can store the hash of the failed messages instead](https://0xsimao.com/findings/fuji-finance-handler-store-hash-messages) - [When recording failed transactions in ConnextHandler, getting the next Nonce involves an unnecessary for loop](https://0xsimao.com/findings/fuji-finance-recording-transactions-nonce-loop) - [Mismatching calldata in _crossTransferWithCalldata(...) and xReceive(...) in ConnextRouter](https://0xsimao.com/findings/fuji-finance-mismatching-calldata-cross-transfer) - [In ConnextHandler, executeFailedWithUpdatedArgs(...), the whole tx is updated on storage if the try call succeeds](https://0xsimao.com/findings/fuji-finance-whole-storage-try-succeeds) - [When transferring tokens, if the amount is 0, the transfer should be skipped](https://0xsimao.com/findings/fuji-finance-transferring-amount-transfer-skipped) - [xBundle(...) and xReceive(...) should have nonReentrant modifiers](https://0xsimao.com/findings/fuji-finance-bundle-non-reentrant-modifiers) - [_to argument missing 0x0 address check in the ConnextRouter](https://0xsimao.com/findings/fuji-finance-argument-0x0-address-connext) - [_checkNoBalanceChange(...) cycle should break in BaseRouter](https://0xsimao.com/findings/fuji-finance-balance-change-cycle-break) - [_handleSwapAction(...) creates situations where the arguments receiver and sweeper need to be the same address in BaseRouter](https://0xsimao.com/findings/fuji-finance-handle-creates-situations-sweeper) - [Constants should be placed as constants and not hardcoded for better readability](https://0xsimao.com/findings/fuji-finance-constants-hardcoded-better-readability) - [_tempTokenToCheck in BaseRouter does not need to be a state variable](https://0xsimao.com/findings/fuji-finance-temp-need-state-variable) - [Unnecessary extra condition in if statement](https://0xsimao.com/findings/fuji-finance-unnecessary-extra-condition-statement) - [Useless else statement](https://0xsimao.com/findings/fuji-finance-useless-else-statement) - [Saving parameters in memory without using them spends gas](https://0xsimao.com/findings/fuji-finance-saving-memory-spends-gas) - [Don't return the same memory variable if your passing it as argument](https://0xsimao.com/findings/fuji-finance-memory-your-passing-argument) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2023-05-06-fuji-finance.pdf)