If you notice some outdated information please let us know!
Process Quality Review (0.8)
Curve Finance
PASS
Security Incidents
Scoring Appendix
The final review score is indicated as a percentage. The percentage is calculated as Achieved Points due to MAX Possible Points. For each element the answer can be either Yes/No or a percentage. For a detailed breakdown of the individual weights of each question, please consult this document.
Very simply, the audit looks for the following declarations from the developer's site. With these declarations, it is reasonable to trust the smart contracts.
- Here is my smart contract on the blockchain
- You can see it matches a software repository used to develop the code
- Here is the documentation that explains what my smart contract does
- Here are the tests I ran to verify my smart contract
- Here are the audit(s) performed to review my code by third party experts
This report is for informational purposes only and does not constitute investment advice of any kind, nor does it constitute an offer to provide investment advisory or other services. Nothing in this report shall be considered a solicitation or offer to buy or sell any security, token, future, option or other financial instrument or to offer or provide any investment advice or service to any person in any jurisdiction. Nothing contained in this report constitutes investment advice or offers any opinion with respect to the suitability of any security, and the views expressed in this report should not be taken as advice to buy, sell or hold any security. The information in this report should not be relied upon for the purpose of investing. In preparing the information contained in this report, we have not taken into account the investment needs, objectives and financial circumstances of any particular investor. This information has no regard to the specific investment objectives, financial situation and particular needs of any specific recipient of this information and investments discussed may not be suitable for all investors.
Any views expressed in this report by us were prepared based upon the information available to us at the time such views were written. The views expressed within this report are limited to DeFiSafety and the author and do not reflect those of any additional or third party and are strictly based upon DeFiSafety, its authors, interpretations and evaluation of relevant data. Changed or additional information could cause such views to change. All information is subject to possible correction. Information may quickly become unreliable for various reasons, including changes in market conditions or economic circumstances.
This completed report is copyright (c) DeFiSafety 2023. Permission is given to copy in whole, retaining this copyright label.
Smart Contracts & Team
100%
This section looks at the code deployed on the relevant chain that gets reviewed and its corresponding software repository. The document explaining these questions is here.
1. Are the smart contract addresses easy to find? (%)
Smart contracts are easily located. . Just look at the footer of the website and Contracts. However, the contract addresses only appear to be visible for Ethereum mainnet. Still the pool addresses are all on the website for every chain. Finally in the docs is this. This is all a user needs, 100%
2. How active is the primary contract? (%)
Contract 3Poolis used more than10 times a day, as indicated in the Appendix. This is just one (the most popular) of many pools in the Curve protocol.
3. Does the protocol have a public software repository? (Y/N)
Curve uses GitHub as a software repository.
4. Is there a development history visible? (%)
At 898 commits, this repo is almost as endless as Curve's logo.
5. Is the team public (not anonymous)?
Four team members in the GitHub are public and they self-report working for Curve. One of the founders, Michael Egorov, can also be found at https://www.linkedin.com/in/michael-egorov/.
Documentation
94%
This section looks at the software documentation. The document explaining these questions is here.
6. Is there a whitepaper? (Y/N)
Curve has multiple whitepapers, though the most user accessible is their Gitbook.
7. Is the protocol's software architecture documented? (Y/N)
Curve's software architecture is well documented using specific references to contracts.
8. Does the software documentation fully cover the deployed contracts' source code? (%)
The software function documentation covers all contracts deployed. Here is the example for the StableSwap code.
9. Is it possible to trace the documented software to its implementation in the protocol's source code? (%)
There is strong association between code and documents, but there is no explicit traceability.
Testing
72%
10. Has the protocol tested their deployed code? (%)
Code examples are in the Appendix at the end of this report.. As per the SLOC, there is 302% testing to code (TtC). This score is guided by the Test to Code ratio (TtC). Generally a good test to code ratio is over 100%. However, the reviewer's best judgement is the final deciding factor. For doing this calculation, we removed duplicate files (common within Curve) as these duplicate files would have the same test files. Examples of duplicate files are one Deposit and StableSwap for each token. This gives a TtC calc of 5917 /1953 - 302% ─────────────────────────────────────────────────────────────────────────────── Language Files Lines Blanks Comments Code Complexity ─────────────────────────────────────────────────────────────────────────────── Python 7 1953 207 330 1416 74 ─────────────────────────────────────────────────────────────────────────────── Total 7 1953 207 330 1416 74 ─────────────────────────────────────────────────────────────────────────────── Estimated Cost to Develop $38,923 Estimated Schedule Effort 4.005848 months Estimated People Required 0.863243 ─────────────────────────────────────────────────────────────────────────────── Processed 61994 bytes, 0.062 megabytes (SI) ─────────────────────────────────────────────────────────────────────────────── ─────────────────────────────────────────────────────────────────────────────── Language Files Lines Blanks Comments Code Complexity ─────────────────────────────────────────────────────────────────────────────── Python 66 5843 1364 356 4123 592 Markdown 1 74 25 0 49 0 ─────────────────────────────────────────────────────────────────────────────── Total 67 5917 1389 356 4172 592 ─────────────────────────────────────────────────────────────────────────────── Estimated Cost to Develop $121,047 Estimated Schedule Effort 6.165065 months Estimated People Required 1.744356 ─────────────────────────────────────────────────────────────────────────────── Processed 189148 bytes, 0.189 megabytes (SI) ───────────────────────────────────────────────────────────────────────────────
11. How covered is the protocol's code? (%)
Although the protocol offers a code coverage report for users running their own tests, there are no results. . However, with clear in-depth testing practices, Curve gets a 60% for this question.
12. Does the protocol provide scripts and instructions to run their tests? (Y/N)
Curve provides scripts.
13. Is there a detailed report of the protocol's test results?(%)
No test report is evident.
14. Has the protocol undergone Formal Verification? (Y/N)
Curve has not undergone formal verification.
15. Were the smart contracts deployed to a testnet? (Y/N)
Curve uses testnets with their various deployments to new networks.
Security
95%
This section looks at the 3rd party software audits done. It is explained in this document.
16. Is the protocol sufficiently audited? (%)
Curve has been audited three times, two of which were pre-launch.
17. Is the bounty value acceptably high (%)
Curve offers $250K with a static program.
Admin Controls
97%
This section covers the documentation of special access controls for a DeFi protocol. The admin access controls are the contracts that allow updating contracts or coefficients in the protocol. Since these contracts can allow the protocol admins to "change the rules", complete disclosure of capabilities is vital for user's transparency. It is explained in this document.
18. Is the protocol's admin control information easy to find?
Admin controls are easy to find. However, they need updating so that users can find them all in one location with sufficient detail yet still in straightforward language.
19. Are relevant contracts clearly labelled as upgradeable or immutable? (%)
The relevant contracts are identified as immutable, as identified here. Where it says "Smart contracts cannot be upgraded with the admin key. "
20. Is the type of smart contract ownership clearly indicated? (%)
Ownership is in the hands of the DAO, as stated.
21. Are the protocol's smart contract change capabilities described? (%)
Smart contracts are immutable. Contracts are not capable of change.
22. Is the protocol's admin control information easy to understand? (%)
Information regarding admin control and its relation to user funds' safety is clearly described at https://resources.curve.fi/faq/security. Contracts are immutable.
23. Is there sufficient Pause Control documentation? (%)
An in-depth mention of a their pause control is documented here. There is no evidence of testing.
24. Is there sufficient Timelock documentation? (%)
No timelock documentation is detailed. However, their DAO structure fundamentally operates like a timelock due to admin's giving up ownership to the DAO, and every vote on contract changes has to go through a lengthy voting process. In addition, Curve has clearly stated that the only contract that the DAO does not have full ownership of is the CRV DAO token. Regardless, the token contract restricts all admin access and external call possibilities. This renders the need for a timelock effectively useless for any Curve contract.
25. Is the Timelock of an adequate length? (Y/N)
The voting of the DAO acting as a timelock, its length is parallel to the overall voting process which takes 10 days.
Oracles
100%
This section goes over the documentation that a protocol may or may not supply about their Oracle usage. Oracles are a fundamental part of DeFi as they are responsible for relaying tons of price data information to thousands of protocols using blockchain technology. Not only are they important for price feeds, but they are also an essential component of transaction verification and security. These questions are explained in this document.
26. Is the protocol's Oracle sufficiently documented? (%)
Curve uses TWAP oracles.
27. Is front running mitigated by this protocol? (Y/N)
Curve details front-running mitigation in their docs.
28. Can flashloan attacks be applied to the protocol, and if so, are those flashloan attack risks mitigated? (Y/N)
Flashloan countermeasures are implemented.
Appendices
1Enter appendix example code here