From 06faa9d648da7f79f1c332d324cccc8adf3f80a6 Mon Sep 17 00:00:00 2001 From: kingofclubstroy <100493790+kingofclubstroyDev@users.noreply.github.com> Date: Wed, 29 May 2024 15:20:24 -0700 Subject: [PATCH 1/2] sevenSeas-7 --- .../library/library/audits/sevenSeas-7.html | 41 +++++++++++++++++++ .../public/sevenSeas-7-issues.html | 36 ++++++++++++++++ 2 files changed, 77 insertions(+) create mode 100644 client/library/library/audits/sevenSeas-7.html create mode 100644 content/collections/public/sevenSeas-7-issues.html diff --git a/client/library/library/audits/sevenSeas-7.html b/client/library/library/audits/sevenSeas-7.html new file mode 100644 index 00000000..fbb3bb54 --- /dev/null +++ b/client/library/library/audits/sevenSeas-7.html @@ -0,0 +1,41 @@ + + + The security audit was performed by the Macro security team on May 22nd 2024. + + + + +

+ Specifically, we audited the following contracts within this repository, and reviewed the migration steps to move assets from the Liquid cellar to a Liquid boring vault. +

+ + + + + \ No newline at end of file diff --git a/content/collections/public/sevenSeas-7-issues.html b/content/collections/public/sevenSeas-7-issues.html new file mode 100644 index 00000000..310152bd --- /dev/null +++ b/content/collections/public/sevenSeas-7-issues.html @@ -0,0 +1,36 @@ + + Use Cases + medium + low + fixed + 8de7678302b9f52c52315b43e6cd16d9cf6e5121 + + ## [L-1] Contracts facilitating transfers may want to be blocked as well + + With the addition of a blacklist to boring vaults, currently only the sender and receiver of the shares are passed to the teller in `beforeTransfer()` to check if they are blacklisted: + + ```solidity + /** + * @notice Implement beforeTransfer hook to check if shares are locked, or if `from` or `to` are on the deny list. + */ + function beforeTransfer(address from, address to) external view { + if (denyList[from] || denyList[to]) revert TellerWithMultiAssetSupport__TransferDenied(from, to); + if (shareUnlockTime[from] >= block.timestamp) revert TellerWithMultiAssetSupport__SharesAreLocked(); + } + ``` + Reference: [TellerWithMultiAssetSupport.sol#L210-L216](https://github.com/Se7en-Seas/boring-vault/blob/9c6e1e4458fba53f2ff09efe21195dcf570ffc3e/src/base/Roles/TellerWithMultiAssetSupport.sol#L210-L216) + + However, when shares are transferred via `transferFrom()`, an approved operator facilitates the transfer, but in doing so this could be a contract that is involved in illegal or malicious behaviour that may want to be blocked. This may be unlikely but if contracts can be sanctioned as tornado cash was, in order to remain compliant with current or future regulations, it may be wise to allow for the ability to block operators in case it becomes necessary. + + + + + Informational + medium + + ## [I-1] Addresses can be blacklisted from interacting with boringVault shares + + There is now the ability for an authorized role to update a `denyList` which prevents any address on the list from sending, receiving, or facilitating the transfer of vault shares. Although this is an accepted practice, and widely used tokens like USDC also have blacklist functionality, users should be aware that they can have their shares frozen. Blacklisting addresses should typically only be done to freeze assets of malicious users or prevent interaction with undesired contracts. Developers should also be aware that for contracts interacting with these shares, that either users or the contract itself can be blacklisted, which may adversely effect the contracts functionality. + + + \ No newline at end of file From 2828e7d97af3749bb4b9a85871a1a5209b2a1459 Mon Sep 17 00:00:00 2001 From: kingofclubstroy <100493790+kingofclubstroyDev@users.noreply.github.com> Date: Wed, 29 May 2024 15:25:55 -0700 Subject: [PATCH 2/2] punctuation --- client/library/library/audits/sevenSeas-7.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/library/library/audits/sevenSeas-7.html b/client/library/library/audits/sevenSeas-7.html index fbb3bb54..4707c0e7 100644 --- a/client/library/library/audits/sevenSeas-7.html +++ b/client/library/library/audits/sevenSeas-7.html @@ -16,7 +16,7 @@ Trust Assumptions: - In addition to the trust assumptions mentioned in [SevenSeas-4](https://0xmacro.com/library/audits/sevenSeas-4.html), and [SevenSeas-5](https://0xmacro.com/library/audits/sevenSeas-5.html) this update allows addresses to be blacklisted from interacting with boringVault shares. Users must trust that addresses with the role authorized to update the blacklist will do so in the interest of the protocol and not freeze users assets without good reason. + In addition to the trust assumptions mentioned in [SevenSeas-4](https://0xmacro.com/library/audits/sevenSeas-4.html), and [SevenSeas-5](https://0xmacro.com/library/audits/sevenSeas-5.html), this update allows addresses to be blacklisted from interacting with boringVault shares. Users must trust that addresses with the role authorized to update the blacklist will do so in the interest of the protocol and not freeze users assets without good reason.