Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Takara Lend Contracts>Threat Model>Component: Utility contracts
GeneralOverview
Findings
Critical (1)
High (2)
Medium (1)
Low (4)
Informational (3)
DiscussionMisleadingly named liquidatable global flagUnused added constants in TTokenStoragePotential revert griefing in the liquidation flow
Threat ModelComponent: ComptrollerComponent: ErrorReporterComponents: TErc20Delegator, TErc20, and TTokenComponent: JumpRateModelComponent: RateComponent: Oracle contractsComponent: Utility contracts
Audit ResultsAssessment Results

Component: Utility contracts

Description

The AssetDeployer contract is used for the deployment and configuration of markets. The Addresses contract serves as a repository for managing contract addresses across different networks for the deployment. The MarketState contract shows information about all active markets, including current operational status such as LTV, TVL, and interest rate.

Invariants

  • AssetDeployer should create and configure markets securely.

  • Addresses should manage contract addresses correctly.

  • MarketState should show correct information about all active markets.

Test coverage

Cases covered

  • Create a market contract.

  • Configure a new market and mint tToken.

  • Successfully be able to harvest rewards.

Attack surface

The market may be vulnerable to an inflation attack.

Zellic © 2025Back to top ↑