SyncSwap Labs
January 26, 2024
Aqua Pool
Findings Impact LevelCount
Critical
0
High
0
Medium
1
Low
1
Informational
0
CriticalHighMediumLowInformational
Prepared by
Vlad ToieEngineer[email protected]
Filippo CremoneseEngineer[email protected]
Aaron EsauEngineer[email protected]
About

SyncSwap is a seamless and efficient decentralized exchange on Ethereum ZK rollups. Powered by zero-knowledge technology, SyncSwap brings more people easy-to-use and low-cost DeFi with complete Ethereum security. It aims to provide a seamless and efficient decentralized exchange on the zkSync Era network.

Aqua Pool is a pool with automated concentrated liquidity to support exchange between two tokens on Ethereum ZK rollup networks (such as zkSync Era, Linea, and Scroll).

It is a fork of Curve Finance’s V2 twoCrypto pool; the main logics are expected to be the same, and the math library reuses the original Vyper library from Curve. However, the interfaces (such as member and event naming, fee management, and precision) are changed to adopt the SyncSwap interface. The whole repo is built for SyncSwap V2, and the most significant change from V1 is the introduction of the Crypto Pool (or called “Aqua Pool”) and the removal of the Vault contract. (This means pool funds are now stored in the individual pool contract instead of the singleton vault contract.)

Executive Summary

Zellic conducted a security assessment for SyncSwap Labs from January 22nd to January 26th, 2024. During this engagement, Zellic reviewed Aqua Pool's code for security vulnerabilities and functional issues introduced when porting the mathematics of Curve twoCrypto V2's pool.

Zellic © 2024Back to top ↑