A multi-chain decentralized leveraged exchange featuring instant settlement and guaranteed price execution on 30+ pairs.
Platform: Code4rena
Start Date: 09/12/2022
End Date: 16/12/2022
Period: 7 days
Status: Completed
Pot Size: $90,500 USDC
Participants: 84
Reporter: itsmetechjay
Judge: GalloDaSballo
Id: 192
League: ETH
KingNFT | 1/84 | $11,888.94 | 8 | 4 | 2 | 4 | 0 | 0 | 0 | 0 |
Bobface | 2/84 | $10,938.78 | 2 | 2 | 2 | 0 | 0 | 0 | 0 | 0 |
unforgiven | 3/84 | $5,519.19 | 8 | 2 | 0 | 5 | 2 | Grade A | 0 | 0 |
hansfriese | 4/84 | $4,709.84 | 7 | 4 | 0 | 2 | 0 | Grade A | 0 | 0 |
0x52 | 5/84 | $4,080.61 | 6 | 2 | 0 | 4 | 1 | 0 | 0 | 0 |
__141345__ | 6/84 | $3,067.24 | 9 | 2 | 0 | 7 | 1 | 0 | 0 | 0 |
0xA5DF | 7/84 | $2,923.43 | 5 | 1 | 0 | 4 | 1 | 0 | 0 | 0 |
carlitox477 | 8/84 | $2,380.34 | 3 | 0 | 0 | 3 | 1 | 0 | 0 | 0 |
0xdeadbeef0x | 9/84 | $2,086.69 | 6 | 0 | 0 | 6 | 1 | 0 | 0 | 0 |
IllIllI | 10/84 | $2,083.78 | 2 | 0 | 0 | 0 | 0 | Grade A | Grade A | 0 |
Auditor per page
The C4audit output for the contest can be found here within an hour of contest opening.
Note for C4 wardens: Anything included in the C4udit output is considered a publicly known issue and is ineligible for awards.
Tigris is a leveraged trading platform that utilizes price data signed by oracles off-chain to provide atomic trades and real-time pair prices. Open positions are minted as NFTs, making them transferable. Tigris is governed by Governance NFT holders.
The oracle aggregates real-time spot market prices from CEXs and sign them. Traders include the price data and signature in the trade txs.
For people that want to provide liquidity, they can lock up tigAsset tokens (such as tigUSD, received by depositing the appropriate token into the stablevault) for up to 365 days. They will receive trading fees through an allocation of Governance NFTs, which get distributed based on amount locked and lock period.
List all files in scope in the table below -- and feel free to add notes here to emphasize areas of focus.
| Contract | SLOC | Purpose | Libraries used |
|---|---|---|---|
| contracts/Trading.sol | 794 | Contains most trading contract logic | @openzeppelin/* |
| contracts/TradingExtension.sol | 195 | Some trading logic is delegated this contract | @openzeppelin/* |
| contracts/utils/TradingLibrary.sol | 76 | Verifies oracle signature, calculates PnL and liquidation price. Checks against Chainlink's public price feeds. | @openzeppelin/* |
| contracts/Position.sol | 219 | Position NFT that stores all position data | @openzeppelin/* |
| contracts/PairsContract.sol | 106 | Stores info about pairs such as open interest and fees | @openzeppelin/* |
| contracts/Referrals.sol | 56 | Stores referral codes and referred addresses | @openzeppelin/* |
| contracts/GovNFT.sol | 263 | NFT that utilizes LayerZero for bridging and contains token reward distribution logic | @openzeppelin/* |
| contracts/StableToken.sol | 46 | Mintable and burnable ERC20 | @openzeppelin/* |
| contracts/StableVault.sol | 66 | Holds liquidity for StableToken | @openzeppelin/* |
| contracts/Lock.sol | 87 | Manages bond interaction logic for end-users | @openzeppelin/* |
| contracts/BondNFT.sol | 284 | Bond NFTs minted by locking StableTokens and is managed by Lock.sol | @openzeppelin/* |
| contracts/utils/MetaContext.sol | 27 | Context overridden for meta transactions | @openzeppelin/* |
| contracts/interfaces/IBondNFT.sol | 36 | Bond interface | |
| contracts/interfaces/IGovNFT.sol | 7 | Gov NFT interface | |
| contracts/interfaces/ILayerZeroEndpoint.sol | 19 | LayerZero endpoint interface | |
| contracts/interfaces/ILayerZeroReceiver.sol | 4 | LayerZero receiver interface | |
| contracts/interfaces/ILayerZeroUserApplicationConfig.sol | 7 | LayerZero Config interface | |
| contracts/interfaces/IPairsContract.sol | 22 | Pairs contract interface | |
| contracts/interfaces/IPosition.sol | 48 | Position NFT interface | |
| contracts/interfaces/IReferrals.sol | 7 | Referrals contract interface | |
| contracts/interfaces/IStableVault.sol | 7 | StableVault interface | |
| contracts/interfaces/ITrading.sol | 101 | ITrading interface |
@openzeppelin/*- If you have a public code repo, please share it here: Repo is private - How many contracts are in scope?: 22 - Total SLoC for these contracts?: 2477 - How many external imports are there?: 4 - How many separate interfaces and struct definitions are there for the contracts within scope?: 20 - Does most of your code generally use composition or inheritance?: yes - How many external calls?: 2 - What is the overall line coverage percentage provided by your tests?: 98.5% - Is there a need to understand a separate part of the codebase / get context in order to audit this part of the protocol?: false - Please describe required context: - Does it use an oracle?: true; our own signature-based oracle - Does the token conform to the ERC20 standard?: true - Are there any novel or unique curve logic or mathematical models?: none - Does it use a timelock function?: yes - Is it an NFT?: we have 2 nfts - Does it have an AMM?: no - Is it a fork of a popular project?: false - Does it use rollups?: true - Is it multi-chain?: true - Does it use a side-chain?: true
npx hardhat test for gas reportsnpx hardhat coverage for coverage