Platform: Code4rena
Start Date: 07/04/2022
End Date: 13/04/2022
Period: 7 days
Status: Completed
Pot Size: $100,000 USDC
Participants: 62
Reporter: liveactionllama
Judge: LSDan
Id: 107
League: ETH
cmichel | 1/62 | $17,759.44 | 5 | 3 | 2 | 1 | 0 | - | 0 | 0 |
hickuphh3 | 2/62 | $14,085.37 | 7 | 4 | 1 | 1 | 0 | - | - | 0 |
rayn | 3/62 | $12,398.13 | 7 | 3 | 1 | 2 | 0 | - | - | 0 |
WatchPug | 4/62 | $11,826.24 | 7 | 3 | 1 | 2 | 1 | - | - | 0 |
Dravee | 5/62 | $10,153.25 | 3 | 1 | 1 | 0 | 0 | - | - | 0 |
TrungOre | 6/62 | $4,882.90 | 3 | 0 | 0 | 2 | 2 | - | 0 | 0 |
berndartmueller | 7/62 | $3,422.65 | 5 | 1 | 0 | 2 | 1 | - | - | 0 |
Kenshin | 8/62 | $2,365.16 | 1 | 0 | 0 | 1 | 1 | 0 | 0 | 0 |
minhquanym | 9/62 | $2,280.15 | 3 | 0 | 0 | 2 | 0 | - | 0 | 0 |
AuditsAreUS | 10/62 | $1,687.18 | 3 | 1 | 0 | 1 | 0 | - | 0 | 0 |
Auditor per page
| Name | Description |
|---|---|
| JPEG'd DAO | DAO governing the JPEG'd DeFi protocol |
| JPEG | Governance token for JPEG'd DAO |
| sJPEG | Token representing staked JPEG |
| PUSd | Stablecoin minted by the DeFi protocol |
| CDP / Collateralized Debt Position | A loan backed by some form of collateral |
| LTV / Loan to Value | Ratio of the debt position to the value of the collateral deposited |
| Curve pool | Liquidity pool on Curve AMM for stablecoin swaps |
| LP token | Token representing a share of a liquidity pool |
| yVault | Vault that invests into an underlying strategy for yield generation |
This contest is open for a week. Representatives from the JPEG'd team will be available to answer any questions in the Code Arena Discord. The focus for the contest is to find any bugs, logic errors, or improvements to the core contracts of the JPEG'd protocol. This may include, among other things, ensuring only owners of deposited NFTs can withdraw, PUSd cannot be minted outside of defined rules, and NFTs are kept safe in the vault contract. Wardens can assume that governance variables are set appropriately, and can reach out on Discord for any further clarification.
JPEG'd is a decentralized lending protocol on the Ethereum blockchain that enables non-fungible token (NFT) holders to open collateralized debt positions (CDPs) using their NFTs as collateral. Users mint PUSd, the native stablecoin of the protocol, enabling them to effectively obtain leverage on their NFTs.
The protocol will be managed by a governance token, JPEG, that will oversee, administer, and change parameters of the protocol.
JPEG'd is completely permissionless, decentralized, and is not controlled by any central entity. JPEG's aim is to bridge DeFi and NFTs and eventually allow any NFT collection, as voted upon by governance, to obtain a line of credit using their NFTs as collateral on the protocol.
The core of the protocol is the NFTVault contract, containing the logic for lending PUSd to users based upon their NFT collateral. As CryptoPunks and EtherRocks predate modern NFT standards, their respective helper contracts are used by NFTVault to implement ERC721 interfaces. PUSd can also be minted by the DAO using fungible assets, as managed by FungibleAssetVaultforDAO.
An overview of the system can be seen here.
The full list of contracts to be reviewed is below, organized by directory.
Escrow contract for non ERC721 NFTs. Handles atomic non ERC721 NFT transfers by using FlashEscrow.
JPEG'd LP Farming. Users can stake their JPEG'd ecosystem LP tokens to get JPEG rewards.
Known issue - due to how the _withdrawReward internal function behaves, in some circustances accrued user rewards are going to be stored in the userRewards mapping.
This behaviour lets users see and claim the amount of rewards stored in the mapping from any pool, regardless of the amount staked. Users will still get the overall correct amount of rewards.
Known errors in the natspec documentation for the newEpoch function - the new epoch's start block has to be greater than block.number, not the previous epoch's end block, and the function may be called during an epoch.
JPEG'd yVault token farm. Users can stake their JPEG'd vault tokens and earn JPEG rewards.
CryptoPunks NFTVault helper contract. Allows compatibility between CryptoPunks and NFTVault.
EtherRocks NFTVault helper contract. Allows compatibility between EtherRocks and NFTVault.
JPEG Locker contract. Contract used by NFTVault to lock JPEG to increase the value of an NFT.
JPEG staking contract. Users can stake JPEG and get sJPEG back.
JPEG - Governance token.
PUSd - JPEG'd Stablecoin. PUSd is minted by NFTVault (backed by NFTs) and FungibleAssetVaultForDAO (backed by fungible assets).
JPEG'd PUSd Convex autocompounding strategy. This strategy autocompounds Convex rewards from the PUSd/USDC/USDT/MIM Curve pool.
JPEG'd strategies controller. Allows members of the STRATEGIST_ROLE to manage all the strategies in the JPEG'd ecosystem.
JPEG'd yVault. Allows users to deposit fungible assets into autocompounding strategy contracts (e.g. StrategyPUSDConvex).
Fungible asset vault (for DAO and ecosystem contracts). Allows the DAO and other whitelisted addresses to mint PUSd using fungible assets as collateral.
NFT lending vault. This contracts allows users to borrow PUSd using NFTs as collateral.