Skip to content

Conversation

@zhoujia6139
Copy link
Contributor

Security Checklist

  • 1. Re-Entrancy
  • 2. Arithmetic Over/Under Flows
  • 3. Unexpected Ether
  • 4. Delegatecall
  • 5. Default Visibilities
  • 6. Entropy Illusion
  • 7. External Contract Referencing
  • 8. Short Address/Parameter Attack (off chain)
  • 9. Unchecked CALL Return Values
  • 10. Race Conditions / Front Running
  • 11. Denial Of Service (DOS)
  • 12. Block Timestamp Manipulation
  • 13. Constructors with Care
  • 14. Uninitialized Storage Pointers
  • 15. Floating Points and Precision
  • 16. Tx.Origin Authentication
  • 17. Address.isContract Re-Entrancy via Constructor

⚠️ NOTES ⚠️

Make sure to think about each of these exploits in this PR.

@zhoujia6139 zhoujia6139 requested a review from a team as a code owner March 11, 2023 03:59
// Map of user's ape compound strategies
mapping(address => ApeCompoundStrategy) _apeCompoundStrategies;
// Reserve storage for ape staking
uint256[20] __apeStakingReserve;
Copy link
Contributor

@0x8f701 0x8f701 Mar 13, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

shall we rename it to be __apeStakingGap

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reserve 有预留的意思,感觉比gap好点吧

);
uint256 availableLiquidityPlusDebt = availableLiquidity + totalDebt;
uint256 usageRatio = totalDebt.rayDiv(availableLiquidityPlusDebt);
require(usageRatio <= 0.8e27, Errors.USAGE_RATIO_TOO_HIGH);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we make this a constant?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这个主要是不确定需求上是不是个constant

VAULT_CONTRACT,
VAULT_CONTRACT,
borrowAmount,
discountRate
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why it's not reserve.currentStableBorrowRate?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Current requirement is using discountRate as borrow rate.

);

uint256 presentValue = IInstantNFTOracle(WITHDRAW_ORACLE)
.getPresentValueByDiscountRate(
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this will return static value but the loan collateral's present value should be dynamic right.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Walid 实现不对吧。presentValue肯定与Duration有关,不能只与discountRate有关。

borrower: msg.sender,
collateralAsset: collateralAsset,
collateralTokenId: collateralTokenId.toUint64(),
collateralAmount: collateralAmount.toUint64(),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

collateralAmount 使用 uint64不太够吧,NFT合约那边 这个amount 有可能是 32e18 这种数据

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

这个不同于erc20的amount,不会很大,之前讨论的是1万 或是 100万

@zhoujia6139 zhoujia6139 force-pushed the eth_instant_withdraw branch from 5a4499c to 6994559 Compare March 15, 2023 00:11
@zhoujia6139 zhoujia6139 force-pushed the eth_instant_withdraw branch from 6994559 to 3bb1016 Compare March 15, 2023 01:51
zhoujia6139 and others added 7 commits March 28, 2023 16:08
* chore: validator launch

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: typo

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: wrong url

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: typo

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: invalidToken

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: chainId

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: validator

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: add setup/shutdown-validators command

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: geth syncing

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: generate deposit data

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: rename to launch-validators

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* feat: add depositContract & register-validators

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: rename

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* feat: initiate eth withdrawal

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: typo

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: lint

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: address comparison

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* feat: use erc1155 instead

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* feat: e2e

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: adds the present value oracle logic

* fix: build

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: use old formula until the new one is fully ready

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: temporary fix

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: support both goerli & zhejiang

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: switch to task

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* fix: zhejiang launch

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: add getter

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: updates the present value formula

* fix: typo

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: adds test function helpers for calculating present value

* chore: use shares

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: typo fix

* chore: typo fix

* chore: typo fix

* chore: adds more test cases for present value logic

* chore: removes unused vars

* chore: fixes tests numbers

* fix: use shares instead

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: fix invalid command & make goerli the default

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: add missing restart always

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* chore: add dummy svg

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

* feat: add basic svg token uri

Signed-off-by: GopherJ <alex_cj96@foxmail.com>

---------

Signed-off-by: GopherJ <alex_cj96@foxmail.com>
Co-authored-by: 0xwalid <walid.wah@gmail.com>
Signed-off-by: GopherJ <alex_cj96@foxmail.com>
Signed-off-by: GopherJ <alex_cj96@foxmail.com>
Signed-off-by: GopherJ <alex_cj96@foxmail.com>
Signed-off-by: GopherJ <alex_cj96@foxmail.com>
Signed-off-by: GopherJ <alex_cj96@foxmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants