Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Chainflip Backend>Threat Model>Pallet: cf-pools
GeneralOverview
Findings
Critical (1)
High (1)
Medium (1)
DiscussionLack of broker fee limitsERC-20 transfer reversions result in stuck fundsType conversion could lead to fund loss
Threat ModelWhat are threat models?1-cf-lp
2-cf-poolsPallet: cf-poolsFunction: `update_buy_interval`Function: `update_pool_enabled`Function: `new_pool`Function: `update_range_order`Function: `set_range_order`Function: `update_limit_order`Function: `set_limit_order`Function: `set_pool_fees`Function: `on_initialize`
3-cf-swapping4-cf-witnesser5-engine
Audit ResultsSummary

Pallet: cf-pools

The cf-pools pallet is responsible for managing liquidity pools (allowing governance to create, enable/disable, and set fees) as well as managing range and limit orders. While the actual logic that computes swap amounts and updates pool state is in another crate implementing the AMM, this pallet does contain some glue code that calls the JIT AMM to accomplish a single leg of a swap (and also deposits an event that signals a swap has taken place).

Additionally, this pallet is also responsible for periodically buying and burning FLIP tokens using USDC fees collected from the swaps, applying deflationary pressure that increases the value of FLIP.

Zellic © 2024Back to top ↑