Papr contest

Papr contest details

• Total Prize Pool: $60,500 USDC
  • HM awards: $42,500 USDC
  • QA report awards: $5,000 USDC
  • Gas report awards: $2,500 USDC
  • Judge + presort awards: $10,000 USDC
  • Scout awards: $500 USDC
• Join C4 Discord to register
• Submit findings using the C4 form
• Read our guidelines for more details
• Starts December 16, 2022 20:00 UTC
• Ends December 21, 2022 20:00 UTC

C4udit / Publicly Known Issues

The C4audit output for the contest can be found here within an hour of contest opening.

There are a number of known limitations that are out of scope for the contest

• It is possible for a malicious/faulty pool to be passed to UniswapOracleFundingRateController
• Many things can go wrong in PaprController and NFTEDA if a malicious/faulty NFT is used
• Many things can go wrong in NFTEDA if a malicious/faulty ERC20 is used for payment asset
• Many things can go wrong in PaprController if a malicious/faulty ERC20 is used for underlying
• Additionally, there are myriad possibilities for the state of the system: Target values, Mark values, oracle prices, Uniswap liquidity, and more. We are open to hearing about possible adverse scenarios, but be aware that we are aware of many and are OK with the possibility.

Overview

Papr facilitates NFT-backed loans. Borrowers deposit allowlisted NFT collateral and mint papr, which can then be exchanged on Uniswap for some other asset. Papr interest rates and the papr trading price are in a constant feedback loop. Interest rates are programmatically updated on chain as a function of papr’s trading price on Uniswap (the lower the trading price, the higher the interest to borrowers), and interest rates in turn affect the trading price, as borrowers open and close loans in response to rates.

Interest accrues to the value of papr itself: over time, new borrowers are allowed less papr for the exact same collateral. When closing a loan, borrowers repay the exact same amount of papr that they minted. However, due to interest charges, it is expected that the market value of papr will have risen since they opened their loan.

To the extent that borrower incentives push the trading price of papr up over time, corresponding to these interest charges, papr holders are rewarded.

As an analogy, for those familiar with perpetuals, we can say that papr adapts the funding rate mechanism to set interest rates for loans and balance borrower and lender demand. In particular, papr tokens were heavily inspired by Squeeth, which pioneered perpetuals built on Uniswap V3 oracles and continuous, in-kind funding payments.

We very strongly encourage everyone to read our whitepaper to understand more!

Commit

Contest code is hosted on Backed's Github, this is the relevant commit https://github.com/with-backed/papr/tree/9528f2711ff0c1522076b9f93fba13f88d5bd5e6

Files in scope

External imports

• @reservoir/ReservoirOracle.sol
  • src/ReservoirOracleUnderwriter.sol
• fullrange/libraries/FullMath.sol
  • src/libraries/OracleLibrary.sol
  • src/libraries/UniswapHelpers.sol
• fullrange/libraries/TickMath.sol
  • src/libraries/OracleLibrary.sol
  • src/libraries/UniswapHelpers.sol
• openzeppelin-contracts/access/Ownable2Step.sol
  • src/PaprController.sol
• solady/utils/Multicallable.sol
  • src/PaprController.sol
• solmate/tokens/ERC20.sol
  • src/NFTEDA/NFTEDA.sol
  • src/NFTEDA/interfaces/INFTEDA.sol
  • src/PaprController.sol
  • src/PaprToken.sol
  • src/UniswapOracleFundingRateController.sol
  • src/interfaces/IFundingRateController.sol
  • src/interfaces/IPaprController.sol
• solmate/tokens/ERC721.sol
  • src/NFTEDA/NFTEDA.sol
  • src/NFTEDA/interfaces/INFTEDA.sol
  • src/PaprController.sol
  • src/ReservoirOracleUnderwriter.sol
  • src/interfaces/IPaprController.sol
• solmate/utils/FixedPointMathLib.sol
  • src/NFTEDA/extensions/NFTEDAStarterIncentive.sol
  • src/NFTEDA/libraries/EDAPrice.sol
  • src/PaprController.sol
  • src/UniswapOracleFundingRateController.sol
• solmate/utils/SafeCastLib.sol
  • src/UniswapOracleFundingRateController.sol
• solmate/utils/SafeTransferLib.sol
  • src/NFTEDA/NFTEDA.sol
  • src/PaprController.sol
• v3-core/contracts/interfaces/IUniswapV3Factory.sol
  • src/libraries/UniswapHelpers.sol
• v3-core/contracts/interfaces/IUniswapV3Pool.sol
  • src/libraries/OracleLibrary.sol
  • src/libraries/UniswapHelpers.sol
• v3-core/contracts/libraries/SafeCast.sol
  • src/NFTEDA/libraries/EDAPrice.sol
  • src/libraries/UniswapHelpers.sol

Scoping details answers

- If you have a public code repo, please share it here:  No, private right now
- How many contracts are in scope?: 14  
- Total SLoC for these contracts?:  1043
- How many external imports are there?: 11 
- How many separate interfaces and struct definitions are there for the contracts within scope?:  12
- Does most of your code generally use composition or inheritance?:   about 50/50
- How many external calls?:   5
- What is the overall line coverage percentage provided by your tests?:  80%
- Is there a need to understand a separate part of the codebase / get context in order to audit this part of the protocol?:   True
- Please describe required context:   Protocol is built on top of Uniswap v3, and so some uniswap understanding required. 
- Does it use an oracle?:  true; We use Uniswap v3 on chain and also use Reservoir oracle for NFT prices, in the TrustUs model
- Does the token conform to the ERC20 standard?:  Yes
- Are there any novel or unique curve logic or mathematical models?: We use a funding rate mechanism similar to squeeth, see formula in whitepaper https://backed.mirror.xyz/8SslPvU8of0h-fxoo6AybCpm51f30nd0qxPST8ep08c
- Does it use a timelock function?:  No
- Is it an NFT?: No
- Does it have an AMM?: We use Uniswap v3  
- Is it a fork of a popular project?:   false
- Does it use rollups?:   false
- Is it multi-chain?:  false
- Does it use a side-chain?: false

Additional Context

Here Is a simple Google Sheet you can play with to understand how Target changes in response to Mark and time.

If you're using Slither, ensure you're using the latest version to avoid this sourceMap issue: crytic/crytic-compile#281.

Running code

foundryup + forge install + forge test will get you up and going. (More info on Foundry here). Most of the PaprController tests are forking tests: relying on real chain state. To get these working, add an RPC url value (e.g. from Alchemy or Infura) for MAINNET_RPC_URL in a .env file or otherwise run export MAINNET_RPC_URL=<your-mainnet-rpc-url-goes-here>