Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Beefy UniswapV3>Threat Model>harvest
GeneralOverview
Findings
Critical (1)
High (2)
Medium (2)
Low (5)
Informational (1)
DiscussionImpact of price manipulationsCentralization riskInitializers not calledTest suiteVault withdraw simplificationObservation cardinalityPositions might jump due to tick spacing
Threat ModelWhat are threat models?BeefyVaultConcLiq.solBeefyVaultConcLiqFactory.solStrategyFactory.sol
StrategyPassiveManagerUniswap.sol_addLiquidity_removeLiquiditybeforeActiondepositharvestpanicsetDeviationsetLpToken0ToNativePathsetLpToken1ToNativePathsetPositionWidthuniswapV3MintCallbackunpausewithdraw
Audit ResultsSummary

Function: harvest()

Harvest fees from the pool, charge fees for Beefy, then readjust positions.

Branches and code coverage

Intended branches

  • Reset the fees0 counter.

  • Reset the fees1 counter.

  • Should forward part of the fees to tx.origin.

  • Set the totalLocked0 counter.

  • Set the totalLocked1 counter.

  • Set the lastHarvest to the current block timestamp.

  • Claim fees from the pool and collect them.

  • Charge fees for Beefy and send them to the appropriate addresses — charge fees to accrued state fee amounts.

  • Remove the liquidity.

  • Readjust the ticks.

  • Add the liquidity.

  • Reset the state fees to zero.

Negative behavior

  • Should not be callable unless the period is calm. Currently not implemented.

Zellic © 2025Back to top ↑