# Mitosis audit Three Sigma · Cross-chain liquidity layer 1 · 25th June 2024 A private security review of Mitosis (cross-chain liquidity layer 1), conducted with Three Sigma and completed on 25th June 2024 over 11 days. 0xSimao disclosed 32 findings: 2 high severity, 5 medium, 6 low and 19 informational. ## What Mitosis is Mitosis is an ecosystem-owned-liquidity layer 1: LPs deposit assets on connected chains and receive miAssets on the hub, governance allocates that pooled liquidity across networks and protocols, and Hyperlane-style mailboxes carry the messages between them. ## Scope The review covered the deposit and redemption pipeline: vaults on spoke chains, the redeem queue on the hub that matches exits to available liquidity, fee handling for non-standard tokens, and the executor/mailbox permissioning that moves instructions across chains. ## High severity findings - [BasicVault::_redeem() burns newAmount but redeems amount, allowing attackers to drain the vault](https://0xsimao.com/findings/mitosis-redeem-burns-redeems-drain) - [BasicVault is incompatible with fee-on-transfer tokens](https://0xsimao.com/findings/mitosis-basic-incompatible-fee-transfer) ## Medium severity findings - [Metadata is not set in Cap, which is required by the inherited Router to specify gas limit to the mailbox](https://0xsimao.com/findings/mitosis-metadata-inherited-gas-mailbox) - [StrategyExecutor::disableStrategy() disables the wrong strategy](https://0xsimao.com/findings/mitosis-executor-disable-disables-wrong) - [RedeemQueue::getAvailableResolveRange() incorrectly returns false if from == count - 1](https://0xsimao.com/findings/mitosis-redeem-queue-resolve-range) - [BasicVault::_redeem() does not correctly deal with a disabled redeem queue after it was enabled](https://0xsimao.com/findings/mitosis-redeem-correctly-queue-enabled) - [BasicVault::_deposit() should always resolve with idle balance as the redeem queue may be disabled with requests pending](https://0xsimao.com/findings/mitosis-deposit-resolve-redeem-queue) ## Low severity findings - [Protocol should disable renouncing ownership if it is never intended](https://0xsimao.com/findings/mitosis-disable-renouncing-ownership-intended) - [The StrategyExecutor can remain in a paused state if the owner renounces control while it's paused](https://0xsimao.com/findings/mitosis-remain-paused-renounces-control) - [BasicVault::manualRedeem() and BasicVault::manualDeposit() are inconsistent](https://0xsimao.com/findings/mitosis-manual-redeem-deposit-inconsistent) - [BasicVault::getRedeemRequestOf() will revert as the redeem requests are filled with the wrong indexes](https://0xsimao.com/findings/mitosis-redeem-revert-filled-indexes) - [Cap::receive() does not place restrictions in the sender, which may lead to donations](https://0xsimao.com/findings/mitosis-place-restrictions-sender-donations) - [_msgSender() is mixed with msg.sender](https://0xsimao.com/findings/mitosis-msg-sender-mixed) ## Informational findings - [Adopt named mappings for clarity](https://0xsimao.com/findings/mitosis-adopt-named-mappings-clarity) - [Linea does not support PUSH0](https://0xsimao.com/findings/mitosis-linea-support-push0) - [BasicVaultFactory::createVault() inconsistent already existing vault check](https://0xsimao.com/findings/mitosis-create-inconsistent-already-existing) - [Initializable constracts should call _disableInitializers() in the constructor instead of using the initializer modifier](https://0xsimao.com/findings/mitosis-initializable-constracts-initializers-initializer) - [pragma abicoder v2; is turned on by default after a certain solidity version](https://0xsimao.com/findings/mitosis-pragma-abicoder-turned-version) - [RedeemQueue::isResolved() resolvedCount always returns requestIds.length](https://0xsimao.com/findings/mitosis-redeem-queue-resolved-count) - [RedeemQueue::findOffsetIndex() does not check the last index](https://0xsimao.com/findings/mitosis-redeem-queue-offset-index) - [Structs in RedeemQueue are out of order and should all be placed at the top](https://0xsimao.com/findings/mitosis-structs-redeem-queue-top) - [RedeemQueue could be optimized](https://0xsimao.com/findings/mitosis-redeem-queue-optimized) - [RedeemQueue::get() reverts due to underflow when it should revert and throw the correct error](https://0xsimao.com/findings/mitosis-redeem-queue-reverts-underflow) - [Solidity types uint256 are never negative](https://0xsimao.com/findings/mitosis-solidity-types-uint256-negative) - [BasicVault::_resolveWithIdleBalance() can return before calculating _idleBalance() to save gas](https://0xsimao.com/findings/mitosis-resolve-idle-calculating-gas) - [Storage variables can be cached to save gas](https://0xsimao.com/findings/mitosis-storage-variables-cached-gas) - [decimals() is not part of the ERC20 standard and not all tokens may implement it as expected, which may cause initialize() to fail](https://0xsimao.com/findings/mitosis-decimals-part-erc20-initialize) - [Cap::_checkRemoteStateAndAdvance() may be optimized by returning early as soon as a different epoch is found in a remote domain](https://0xsimao.com/findings/mitosis-remote-returning-soon-epoch) - [The domain with 0 index in Cap::_checkRemoteStateAndAdvance() is not checked for equality](https://0xsimao.com/findings/mitosis-index-remote-advance-equality) - [The current epoch will never advance if there are no other domains](https://0xsimao.com/findings/mitosis-current-epoch-advance-domains) - [Cap::setEpochCap() may add a stale cap](https://0xsimao.com/findings/mitosis-cap-epoch-add-stale) - [In AggregateHook, several if (newAmount == 0) checks are ambiguous](https://0xsimao.com/findings/mitosis-aggregate-hook-several-ambiguous) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2024-06-25-mitosis.pdf)