Linea deployment config#113
Conversation
Summary of Test Results if Merged To Main:
✅ All 107 tests passed! (0 skipped, Total: 107) Test Results for Merge
🔒 Security AnalysisHigh Severity Issuesarbitrary-send-ethImpact: AtomWallet._call(address,uint256,bytes) (src/AtomWallet.sol#214-221) sends eth to arbitrary user Dangerous calls: - (success,result) = target.call{value: value}(data) (src/AtomWallet.sol#215) Affected Files:
View Detailed Findings
Medium Severity IssuesView Medium Severity Issues##### incorrect-equality **Impact**: EthMultiVault._validateTimelock(bytes32) (src/EthMultiVault.sol#2214-2226) uses a dangerous strict equality: - timelock.readyTime == 0 (src/EthMultiVault.sol#2217)Affected Files:
Recommended Actions
⛽ Gas Analysis |
Summary of Test Results if Merged To Main:
✅ All 107 tests passed! (0 skipped, Total: 107) Test Results for Merge
🔒 Security AnalysisHigh Severity Issuesarbitrary-send-ethImpact: AtomWallet._call(address,uint256,bytes) (src/AtomWallet.sol#214-221) sends eth to arbitrary user Dangerous calls: - (success,result) = target.call{value: value}(data) (src/AtomWallet.sol#215) Affected Files:
View Detailed Findings
Medium Severity IssuesView Medium Severity Issues##### incorrect-equality **Impact**: EthMultiVault._validateTimelock(bytes32) (src/EthMultiVault.sol#2214-2226) uses a dangerous strict equality: - timelock.readyTime == 0 (src/EthMultiVault.sol#2217)Affected Files:
Recommended Actions
⛽ Gas Analysis📊 First gas snapshot created |
Summary of Test Results if Merged To Main:
🔒 Security Analysis⛽ Gas Analysis |
Summary of Test Results if Merged To Main:
🔒 Security AnalysisHigh Severity Issuesarbitrary-send-ethImpact: AtomWallet._call(address,uint256,bytes) (src/AtomWallet.sol#214-221) sends eth to arbitrary user Dangerous calls: - (success,result) = target.call{value: value}(data) (src/AtomWallet.sol#215) Affected Files:
View Detailed Findings
reentrancy-ethImpact: Reentrancy in EthMultiVault.batchDeposit(address,uint256[],uint256[]) (src/EthMultiVault.sol#1219-1252): External calls: - _transferFeesToProtocolMultisig(protocolFee) (src/EthMultiVault.sol#1248) - (success,None) = address(generalConfig.protocolMultisig).call{value: value}() (src/EthMultiVault.sol#1418) State variables written after the call(s): - shares[i] = _deposit(receiver,termIds[i],userDepositAfterprotocolFee) (src/EthMultiVault.sol#1247) - vaults[id].totalAssets = totalAssets (src/EthMultiVault.sol#1759) - vaults[id].balanceOf[to] += amount (src/EthMultiVault.sol#1714) - vaults[id].totalShares = totalShares (src/EthMultiVault.sol#1760) EthMultiVault.vaults (src/EthMultiVault.sol#97) can be used in cross function reentrancies: - EthMultiVault.convertToAssets(uint256,uint256) (src/EthMultiVault.sol#2166-2170) - EthMultiVault.convertToShares(uint256,uint256) (src/EthMultiVault.sol#2131-2135) - EthMultiVault.currentSharePrice(uint256) (src/EthMultiVault.sol#2067-2073) - EthMultiVault.getDepositSharesAndFees(uint256,uint256) (src/EthMultiVault.sol#1859-1886) - EthMultiVault.getRedeemAssetsAndFees(uint256,uint256) (src/EthMultiVault.sol#1926-1960) - EthMultiVault.getVaultStateForUser(uint256,address) (src/EthMultiVault.sol#2303-2307) - EthMultiVault.maxRedeem(address,uint256) (src/EthMultiVault.sol#2105-2108) - EthMultiVault.vaults (src/EthMultiVault.sol#97) Affected Files:
View Detailed Findings
Medium Severity IssuesView Medium Severity Issues##### incorrect-equality **Impact**: EthMultiVault._validateTimelock(bytes32) (src/EthMultiVault.sol#2400-2412) uses a dangerous strict equality: - timelock.readyTime == 0 (src/EthMultiVault.sol#2403)Affected Files:
Recommended Actions
⛽ Gas Analysis |
Summary of Test Results if Merged To Main:
🔒 Security AnalysisHigh Severity Issuesarbitrary-send-ethImpact: AtomWallet._call(address,uint256,bytes) (src/AtomWallet.sol#214-221) sends eth to arbitrary user Dangerous calls: - (success,result) = target.call{value: value}(data) (src/AtomWallet.sol#215) Affected Files:
View Detailed Findings
reentrancy-ethImpact: Reentrancy in EthMultiVault.batchDeposit(address,uint256[],uint256[]) (src/EthMultiVault.sol#1219-1252): External calls: - _transferFeesToProtocolMultisig(protocolFee) (src/EthMultiVault.sol#1248) - (success,None) = address(generalConfig.protocolMultisig).call{value: value}() (src/EthMultiVault.sol#1418) State variables written after the call(s): - shares[i] = _deposit(receiver,termIds[i],userDepositAfterprotocolFee) (src/EthMultiVault.sol#1247) - vaults[id].balanceOf[to] += amount (src/EthMultiVault.sol#1714) - vaults[id].totalAssets = totalAssets (src/EthMultiVault.sol#1759) - vaults[id].totalShares = totalShares (src/EthMultiVault.sol#1760) EthMultiVault.vaults (src/EthMultiVault.sol#97) can be used in cross function reentrancies: - EthMultiVault.convertToAssets(uint256,uint256) (src/EthMultiVault.sol#2178-2182) - EthMultiVault.convertToShares(uint256,uint256) (src/EthMultiVault.sol#2143-2147) - EthMultiVault.currentSharePrice(uint256) (src/EthMultiVault.sol#2079-2085) - EthMultiVault.getDepositSharesAndFees(uint256,uint256) (src/EthMultiVault.sol#1871-1898) - EthMultiVault.getRedeemAssetsAndFees(uint256,uint256) (src/EthMultiVault.sol#1938-1972) - EthMultiVault.getVaultStateForUser(uint256,address) (src/EthMultiVault.sol#2315-2319) - EthMultiVault.maxRedeem(address,uint256) (src/EthMultiVault.sol#2117-2120) - EthMultiVault.vaults (src/EthMultiVault.sol#97) Affected Files:
View Detailed Findings
Medium Severity IssuesView Medium Severity Issues##### incorrect-equality **Impact**: EthMultiVault._validateTimelock(bytes32) (src/EthMultiVault.sol#2412-2424) uses a dangerous strict equality: - timelock.readyTime == 0 (src/EthMultiVault.sol#2415)Affected Files:
Recommended Actions
⛽ Gas Analysis |
Summary of Test Results if Merged To Main:
🔒 Security AnalysisHigh Severity Issuesarbitrary-send-ethImpact: AtomWallet._call(address,uint256,bytes) (src/AtomWallet.sol#214-221) sends eth to arbitrary user Dangerous calls: - (success,result) = target.call{value: value}(data) (src/AtomWallet.sol#215) Affected Files:
View Detailed Findings
reentrancy-ethImpact: Reentrancy in EthMultiVault.batchDeposit(address,uint256[],uint256[]) (src/EthMultiVault.sol#1219-1252): External calls: - _transferFeesToProtocolMultisig(protocolFee) (src/EthMultiVault.sol#1248) - (success,None) = address(generalConfig.protocolMultisig).call{value: value}() (src/EthMultiVault.sol#1418) State variables written after the call(s): - shares[i] = _deposit(receiver,termIds[i],userDepositAfterprotocolFee) (src/EthMultiVault.sol#1247) - vaults[id].totalAssets = totalAssets (src/EthMultiVault.sol#1759) - vaults[id].balanceOf[to] += amount (src/EthMultiVault.sol#1714) - vaults[id].totalShares = totalShares (src/EthMultiVault.sol#1760) EthMultiVault.vaults (src/EthMultiVault.sol#97) can be used in cross function reentrancies: - EthMultiVault.convertToAssets(uint256,uint256) (src/EthMultiVault.sol#2178-2182) - EthMultiVault.convertToShares(uint256,uint256) (src/EthMultiVault.sol#2143-2147) - EthMultiVault.currentSharePrice(uint256) (src/EthMultiVault.sol#2079-2085) - EthMultiVault.getDepositSharesAndFees(uint256,uint256) (src/EthMultiVault.sol#1871-1898) - EthMultiVault.getRedeemAssetsAndFees(uint256,uint256) (src/EthMultiVault.sol#1938-1972) - EthMultiVault.getVaultStateForUser(uint256,address) (src/EthMultiVault.sol#2315-2319) - EthMultiVault.maxRedeem(address,uint256) (src/EthMultiVault.sol#2117-2120) - EthMultiVault.vaults (src/EthMultiVault.sol#97) Affected Files:
View Detailed Findings
Medium Severity IssuesView Medium Severity Issues##### incorrect-equality **Impact**: EthMultiVault._validateTimelock(bytes32) (src/EthMultiVault.sol#2412-2424) uses a dangerous strict equality: - timelock.readyTime == 0 (src/EthMultiVault.sol#2415)Affected Files:
Recommended Actions
⛽ Gas Analysis |
| abi.encodeWithSelector(BondingCurveRegistry.initialize.selector, msg.sender); | ||
|
|
||
| // Deploy BondingCurveRegistry proxy | ||
| bondingCurveRegistryProxy = new TransparentUpgradeableProxy( |
There was a problem hiding this comment.
I don't think the bonding curve registry is a proxy, and we don't need this. It doesn't store any important state (outside of the bonding curve IDs), so if we ever wanted a new one we can just deploy a new one and point the multivault config at it.
If we did this, we would need to ensure that any new registry just has the same bonding curve IDs as the old one. Because the curve IDs are tied to the economic state in the MultiVault, we never want to change them. Only add to them.
auroter
left a comment
auroter
left a comment
There was a problem hiding this comment.
Just one minor issue that should be resolved, then I can approve this.
2 participants
The primary reason I created this PR is to have the different deployment scripts ready for rapid deployment and verification at any moment. These include:
chainIdvalidation.chainIdvalidation.As a side note, if you wish to deploy the contracts on the Linea mainnet or Linea Sepolia, make sure to delete the existing
cache,cache_forge,outandbroadcastautogenerated folders from foundry, set theevm_version = "Paris"option infoundry.toml, and then compile the contracts again before running the deployment script.