exclamation mark iconReport an issue

If you notice some outdated information please let us know!

close icon
Your message

Idle v4


Previous versions

Process Quality Review (0.7)

Idle v4

Final score:83%
Date:07 Oct 2021
Audit Process:version 0.7
Author:Nick of DeFiSafety
PQR Score:83%


Scoring Appendix

The final review score is indicated as a percentage. The percentage is calculated as Achieved Points due to MAX Possible Points. For each element the answer can be either Yes/No or a percentage. For a detailed breakdown of the individual weights of each question, please consult this document.

The blockchain used by this protocol

Very simply, the audit looks for the following declarations from the developer's site. With these declarations, it is reasonable to trust the smart contracts.

  • Here is my smart contract on the blockchain
  • You can see it matches a software repository used to develop the code
  • Here is the documentation that explains what my smart contract does
  • Here are the tests I ran to verify my smart contract
  • Here are the audit(s) performed to review my code by third party experts

This report is for informational purposes only and does not constitute investment advice of any kind, nor does it constitute an offer to provide investment advisory or other services. Nothing in this report shall be considered a solicitation or offer to buy or sell any security, token, future, option or other financial instrument or to offer or provide any investment advice or service to any person in any jurisdiction. Nothing contained in this report constitutes investment advice or offers any opinion with respect to the suitability of any security, and the views expressed in this report should not be taken as advice to buy, sell or hold any security. The information in this report should not be relied upon for the purpose of investing. In preparing the information contained in this report, we have not taken into account the investment needs, objectives and financial circumstances of any particular investor. This information has no regard to the specific investment objectives, financial situation and particular needs of any specific recipient of this information and investments discussed may not be suitable for all investors.

Any views expressed in this report by us were prepared based upon the information available to us at the time such views were written. The views expressed within this report are limited to DeFiSafety and the author and do not reflect those of any additional or third party and are strictly based upon DeFiSafety, its authors, interpretations and evaluation of relevant data. Changed or additional information could cause such views to change. All information is subject to possible correction. Information may quickly become unreliable for various reasons, including changes in market conditions or economic circumstances.

This completed report is copyright (c) DeFiSafety 2021. Permission is given to copy in whole, retaining this copyright label.

Code And Team


This section looks at the code deployed on the Mainnet that gets reviewed and its corresponding software repository. The document explaining these questions is here.

1. Are the executing code addresses readily available? (%)

Answer: 100%

They are available at website https://developers.idle.finance/contracts-and-codebase, as indicated in the Appendix.

Percentage Score Guidance:
Clearly labelled and on website, docs or repo, quick to find
Clearly labelled and on website, docs or repo but takes a bit of looking
Addresses in mainnet.json, in discord or sub graph, etc
Address found but labeling not clear or easy to find
Executing addresses could not be found

2. Is the code actively being used? (%)

Answer: 70%

Activity is more that 10 transactions a week on contract IdleDAIYield, as indicated in the Appendix.

Percentage Score Guidance:
More than 10 transactions a day
More than 10 transactions a week
More than 10 transactions a month
Less than 10 transactions a month
No activity

3. Is there a public software repository? (Y/N)

Answer: Yes

Is there a public software repository with the code at a minimum, but also normally test and scripts. Even if the repository was created just to hold the files and has just 1 transaction, it gets a "Yes". For teams with private repositories, this answer is "No"

Score Guidance:
There is a public software repository with the code at a minimum, but also normally test and scripts. Even if the repository was created just to hold the files and has just 1 transaction.
For teams with private repositories.

4. Is there a development history visible? (%)

Answer: 100%

At 400 commits and 6 branches, this protocol's commitment to development history can be described as anything but idle.

This metric checks if the software repository demonstrates a strong steady history. This is normally demonstrated by commits, branches and releases in a software repository. A healthy history demonstrates a history of more than a month (at a minimum).

Percentage Score Guidance:
Any one of 100+ commits, 10+branches
Any one of 70+ commits, 7+branches
Any one of 50+ commits, 5+branches
Any one of 30+ commits, 3+branches
Less than 2 branches or less than 30 commits

5. Is the team public (not anonymous)? (Y/N)

Answer: Yes

For a "Yes" in this question, the real names of some team members must be public on the website or other documentation (LinkedIn, etc). If the team is anonymous, then this question is a "No".



This section looks at the software documentation. The document explaining these questions is here.

6. Is there a whitepaper? (Y/N)

Answer: Yes

7. Are the basic software functions documented? (Y/N)

Answer: Yes

The basic software functions are documented at an identification level.

8. Does the software function documentation fully (100%) cover the deployed contracts? (%)

Answer: 50%

The software function documentation identifies the underlying functions behind the Idle Tranches contract in the README.md of the respective GitHub repository. However, none of the other Idle contracts have this detailed information apart from a architecture diagram.

Percentage Score Guidance:
All contracts and functions documented
Only the major functions documented
79 - 1%
Estimate of the level of software documentation
No software documentation

9. Are there sufficiently detailed comments for all functions within the deployed contract code (%)

Answer: 63%

Code examples are in the Appendix. As per the SLOC, there is 63% commenting to code (CtC).

The Comments to Code (CtC) ratio is the primary metric for this score.

Percentage Score Guidance:
CtC > 100 Useful comments consistently on all code
90 - 70%
CtC > 70 Useful comment on most code
60 - 20%
CtC > 20 Some useful commenting
CtC < 20 No useful commenting

10. Is it possible to trace from software documentation to the implementation in code (%)

Answer: 40%

The documentation lists some of the functions, but there is no explicit traceability and there is no coverage (in software terms) of what the contracts actually are. The UI and some functions are covered, but this is less relevant.

Percentage Score Guidance:
Clear explicit traceability between code and documentation at a requirement level for all code
Clear association between code and documents via non explicit traceability
Documentation lists all the functions and describes their functions
No connection between documentation and code



11. Full test suite (Covers all the deployed code) (%)

Answer: 100%

Code examples are in the Appendix. As per the SLOC, there is 145% testing to code (TtC).

This score is guided by the Test to Code ratio (TtC). Generally a good test to code ratio is over 100%. However the reviewers best judgement is the final deciding factor.

Percentage Score Guidance:
TtC > 120% Both unit and system test visible
TtC > 80% Both unit and system test visible
TtC < 80% Some tests visible
No tests obvious

12. Code coverage (Covers all the deployed lines of code, or explains misses) (%)

Answer: 50%

Idle has an average of 33% code coverage across all contracts according to their Quantstamp audits. However, since they clearly have a robust set of tests, we will up their score to 50% according to the guidance below.

Percentage Score Guidance:
Documented full coverage
99 - 51%
Value of test coverage from documented results
No indication of code coverage but clearly there is a reasonably complete set of tests
Some tests evident but not complete
No test for coverage seen

13. Scripts and instructions to run the tests? (Y/N)

Answer: Yes

Scripts/Instructions location: https://github.com/Idle-Labs/idle-contracts

14. Report of the results (%)

Answer: 0%

There is no test report in the Idle documentation.

Percentage Score Guidance:
Detailed test report as described below
GitHub code coverage report visible
No test report evident

15. Formal Verification test done (%)

Answer: 0%

No formal verification test has been undertaken.

16. Stress Testing environment (%)

Answer: 100%

Idle is deployed in full to the Kovan testnet.



This section looks at the 3rd party software audits done. It is explained in this document.

17. Did 3rd Party audits take place? (%)

Answer: 100%

Both Idle yield and Idle governance have been continuously audited before, during, and after their launches.

Percentage Score Guidance:
Multiple Audits performed before deployment and results public and implemented or not required
Single audit performed before deployment and results public and implemented or not required
Audit(s) performed after deployment and no changes required. Audit report is public
Audit(s) performed after deployment and changes needed but not implemented
No audit performed
Audit Performed after deployment, existence is public, report is not public and no improvements deployed OR smart contract address not found, (where question 1 is 0%)
Deduct 25% if code is in a private repo and no note from auditors that audit is applicable to deployed code.

18. Is the bug bounty acceptable high? (%)

Answer: 90%

Idle Finance's Immunefi program offers up to $500k.

Percentage Score Guidance:
Bounty is 10% TVL or at least $1M AND active program (see below)
Bounty is 5% TVL or at least 500k AND active program
Bounty is 5% TVL or at least 500k
Bounty is 100k or over AND active program
Bounty is 100k or over
Bounty is 50k or over AND active program
Bounty is 50k or over
Bug bounty program bounty is less than 50k
No bug bounty program offered
An active program means that a third party (such as Immunefi) is actively driving hackers to the site. An inactive program would be static mentions on the docs.

Access Controls


This section covers the documentation of special access controls for a DeFi protocol. The admin access controls are the contracts that allow updating contracts or coefficients in the protocol. Since these contracts can allow the protocol admins to "change the rules", complete disclosure of capabilities is vital for user's transparency. It is explained in this document.

19. Can a user clearly and quickly find the status of the access controls (%)

Answer: 100%

Idle finance's admin powers section is clearly labelled in the documentation.

Percentage Score Guidance:
Clearly labelled and on website, docs or repo, quick to find
Clearly labelled and on website, docs or repo but takes a bit of looking
Access control docs in multiple places and not well labelled
Access control docs in multiple places and not labelled
Admin Control information could not be found

20. Is the information clear and complete (%)

Answer: 90%

a) All contracts are clearly labelled as upgradeable (or not) -- 30% -- IdleToken contract is clearly identified as upgradeable, and that it controls all other contracts. The Pause Guardian is also identified as upgradeable and the rebalancer is too.  b) The type of ownership is clearly indicated (OnlyOwner / MultiSig / Defined Roles) -- 30% -- IDLE governance is the sole owner of admin privileges.  c) The capabilities for change in the contracts are described -- 30% -- capacities are clearly identified.

Percentage Score Guidance:
All the contracts are immutable -- 100% OR
a) All contracts are clearly labelled as upgradeable (or not) -- 30% AND
b) The type of ownership is clearly indicated (OnlyOwner / MultiSig / Defined Roles) -- 30% AND
c) The capabilities for change in the contracts are described -- 30%

21. Is the information in non-technical terms that pertain to the investments (%)

Answer: 30%

The information is in software specific language.

Percentage Score Guidance:
All the contracts are immutable
Description relates to investments safety and updates in clear, complete non-software language
Description all in software specific language
No admin control information could be found

22. Is there Pause Control documentation including records of tests (%)

Answer: 80%

A pause guardian is clearly identified with a detailed explanation on how it functions.

Percentage Score Guidance:
All the contracts are immutable or no pause control needed and this is explained OR Pause control(s) are clearly documented and there is records of at least one test within 3 months
Pause control(s) explained clearly but no evidence of regular tests
Pause controls mentioned with no detail on capability or tests
Pause control not documented or explained


 The author of this review is Rex of DeFi Safety.

Email: rex@defisafety.com
Twitter: @defisafety

I started with Ethereum just before the DAO and that was a wonderful education.  It showed the importance of code quality. The second Parity hack also showed the importance of good process.  Here my aviation background offers some value. Aerospace knows how to make reliable code using quality processes.
I was coaxed to go to EthDenver 2018 and there I started SecuEth.org with Bryant and Roman. We created guidelines on good processes for blockchain code development. We got EthFoundation funding to assist in their development Process Quality Reviews are an extension of the SecurEth guidelines that will further increase the quality processes in Solidity and Vyper development. DeFiSafety is my full time gig and we are working on funding vehicles for a permanent staff.

2 * @title: Idle Token Governance main contract
3 * @summary: ERC20 that holds pooled user funds together
4 *           Each token rapresent a share of the underlying pools
5 *           and with each token user have the right to redeem a portion of these pools
6 * @author: Idle Labs Inc., idle.finance
7 */
8pragma solidity 0.5.16;
9import "@openzeppelin/contracts-ethereum-package/contracts/math/SafeMath.sol";
10import "@openzeppelin/contracts-ethereum-package/contracts/token/ERC20/SafeERC20.sol";
1112import "@openzeppelin/contracts-ethereum-package/contracts/token/ERC20/ERC20.sol";
13import "@openzeppelin/contracts-ethereum-package/contracts/token/ERC20/ERC20Detailed.sol";
1415import "@openzeppelin/contracts-ethereum-package/contracts/utils/ReentrancyGuard.sol";
16import "@openzeppelin/contracts-ethereum-package/contracts/ownership/Ownable.sol";
17import "@openzeppelin/contracts-ethereum-package/contracts/lifecycle/Pausable.sol";
1819import "@openzeppelin/upgrades/contracts/Initializable.sol";
2021import "./interfaces/iERC20Fulcrum.sol";
22import "./interfaces/ILendingProtocol.sol";
23import "./interfaces/IGovToken.sol";
24import "./interfaces/IIdleTokenV3_1.sol";
25import "./interfaces/IERC3156FlashBorrower.sol";
26import "./interfaces/IAaveIncentivesController.sol";
2728import "./interfaces/Comptroller.sol";
29import "./interfaces/CERC20.sol";
30import "./interfaces/AToken.sol";
31import "./interfaces/IdleController.sol";
32import "./interfaces/IIdleTokenHelper.sol";
3334import "./GST2ConsumerV2.sol";
3536contract IdleTokenGovernance is Initializable, ERC20, ERC20Detailed, ReentrancyGuard, Ownable, Pausable, IIdleTokenV3_1, GST2ConsumerV2 {
37  using SafeERC20 for IERC20;
38  using SafeMath for uint256;
3940  uint256 private constant ONE_18 = 10**18;
41  // State variables
42  // eg. DAI address
43  address public token;
44  // eg. iDAI address
45  address private iToken;
46  // eg. cDAI address
47  address private cToken;
48  // Idle rebalancer current implementation address
49  address public rebalancer;
50  // Address collecting underlying fees
51  address public feeAddress;
52  // Last iToken price, used to pause contract in case of a black swan event
53  uint256 public lastITokenPrice;
54  // eg. 18 for DAI
55  uint256 private tokenDecimals;
56  // Max unlent assets percentage for gas friendly swaps
57  uint256 public maxUnlentPerc; // 100000 == 100% -> 1000 == 1%
58  // Current fee on interest gained
59  uint256 public fee;
60  // eg. [cTokenAddress, iTokenAddress, ...]
61  address[] public allAvailableTokens;
62  // eg. [COMPAddress, CRVAddress, ...]
63  address[] public govTokens;
64  // last fully applied allocations (ie when all liquidity has been correctly placed)
65  // eg. [5000, 0, 5000, 0] for 50% in compound, 0% fulcrum, 50% aave, 0 dydx. same order of allAvailableTokens
66  uint256[] public lastAllocations;
67  // Map that saves avg idleToken price paid for each user, used to calculate earnings
68  mapping(address => uint256) public userAvgPrices;
69  // eg. cTokenAddress => IdleCompoundAddress
70  mapping(address => address) public protocolWrappers;
71  // array with last balance recorded for each gov tokens
72  mapping (address => uint256) public govTokensLastBalances;
73  // govToken -> user_address -> user_index eg. usersGovTokensIndexes[govTokens[0]][msg.sender] = 1111123;
74  mapping (address => mapping (address => uint256)) public usersGovTokensIndexes;
75  // global indices for each gov tokens used as a reference to calculate a fair share for each user
76  mapping (address => uint256) public govTokensIndexes;
77  // Map that saves amount with no fee for each user
78  mapping(address => uint256) private userNoFeeQty;
79  // variable used for avoid the call of mint and redeem in the same tx
80  bytes32 private _minterBlock;
8182  // Events
83  event Rebalance(address _rebalancer, uint256 _amount);
84  event Referral(uint256 _amount, address _ref);
8586  // ########## IdleToken V4_1 updates
87  // Idle governance token
88  address public constant IDLE = address(0x875773784Af8135eA0ef43b5a374AaD105c5D39e);
89  // Compound governance token
90  address public constant COMP = address(0xc00e94Cb662C3520282E6f5717214004A7f26888);
91  uint256 private constant FULL_ALLOC = 100000;
9293  // Idle distribution controller
94  address public constant idleController = address(0x275DA8e61ea8E02d51EDd8d0DC5c0E62b4CDB0BE);
95  // oracle used for calculating the avgAPR with gov tokens
96  address public oracle;
97  // eg cDAI -> COMP
98  mapping(address => address) private protocolTokenToGov;
99  // Whether openRebalance is enabled or not
100  bool public isRiskAdjusted;
101  // last allocations submitted by rebalancer
102  uint256[] private lastRebalancerAllocations;
103104  // ########## IdleToken V5 updates
105  // Fee for flash loan
106  uint256 public flashLoanFee;
107  // IdleToken helper address
108  address public tokenHelper;
109110  /**
111  * @dev Emitted on flashLoan()
112  * @param target The address of the flash loan receiver contract
113  * @param initiator The address initiating the flash loan
114  * @param amount The amount flash borrowed
115  * @param premium The flash loan fee
116  **/
117  event FlashLoan(
118    address indexed target,
119    address indexed initiator,
120    uint256 amount,
121    uint256 premium
122  );
123124  // Addresses for stkAAVE distribution from Aave
125  address public constant stkAAVE = address(0x4da27a545c0c5B758a6BA100e3a049001de870f5);
126  address private aToken;
127  // ########## End IdleToken V5 updates
128129  // ERROR MESSAGES:
130  // 0 = is 0
131  // 1 = already initialized
132  // 2 = length is different
133  // 3 = Not greater then
134  // 4 = lt
135  // 5 = too high
136  // 6 = not authorized
137  // 7 = not equal
138  // 8 = error on flash loan execution
139  // 9 = Reentrancy
140141  function _init() public {
142    require(oracle == 0xB5A8f07dD4c3D315869405d702ee8F6EA695E8C5);
143    oracle = 0x758C10272A15f0E9D50Cbc035ff9a046945da0F2;
144    flashLoanFee = 20;
145  }
146147  // onlyOwner
148  /**
149   * It allows owner to modify allAvailableTokens array in case of emergency
150   * ie if a bug on a interest bearing token is discovered and reset protocolWrappers
151   * associated with those tokens.
152   *
153   * @param protocolTokens : array of protocolTokens addresses (eg [cDAI, iDAI, ...])
154   * @param wrappers : array of wrapper addresses (eg [IdleCompound, IdleFulcrum, ...])
155   * @param _newGovTokens : array of governance token addresses
156   * @param _newGovTokensEqualLen : array of governance token addresses for each
157   *  protocolToken (addr0 should be used for protocols with no govToken)
158   */
159  function setAllAvailableTokensAndWrappers(
160    address[] calldata protocolTokens,
161    address[] calldata wrappers,
162    address[] calldata _newGovTokens,
163    address[] calldata _newGovTokensEqualLen
164  ) external onlyOwner {
165    require(protocolTokens.length == wrappers.length, "2");
166    require(_newGovTokensEqualLen.length >= protocolTokens.length, '3');
167168    govTokens = _newGovTokens;
169170    address newGov;
171    address protToken;
172    for (uint256 i = 0; i < protocolTokens.length; i++) {
173      protToken = protocolTokens[i];
174      require(protToken != address(0) && wrappers[i] != address(0), "0");
175      protocolWrappers[protToken] = wrappers[i];
176177      // set protocol token to gov token mapping
178      newGov = _newGovTokensEqualLen[i];
179      if (newGov != IDLE) {
180        protocolTokenToGov[protToken] = newGov;
181      }
182    }
183184    allAvailableTokens = protocolTokens;
185  }
186187  /**
188   * It allows owner to set the cToken address
189   *
190   * @param _cToken : new cToken address
191   */
192  function setCToken(address _cToken)
193    external onlyOwner {
194      require((cToken = _cToken) != address(0), "0");
195  }
196197  /**
198   * It allows owner to set the aToken address
199   *
200   * @param _aToken : new aToken address
201   */
202  function setAToken(address _aToken)
203    external onlyOwner {
204      require((aToken = _aToken) != address(0), "0");
205  }
206207  /**
208   * It allows owner to set the tokenHelper address
209   *
210   * @param _tokenHelper : new tokenHelper address
211   */
212  function setTokenHelper(address _tokenHelper)
213    external onlyOwner {
214      require((tokenHelper = _tokenHelper) != address(0), "0");
215  }
216217  /**
218   * It allows owner to set the IdleRebalancerV3_1 address
219   *
220   * @param _rebalancer : new IdleRebalancerV3_1 address
221   */
222  function setRebalancer(address _rebalancer)
223    external onlyOwner {
224      require((rebalancer = _rebalancer) != address(0), "0");
225  }
226227  /*
228   * It allows owner to set the fee (1000 == 10% of gained interest)
229   *
230   * @param _fee : fee amount where 100000 is 100%, max settable is 10%
231   */
232  function setFee(uint256 _fee)
233    external onlyOwner {
234      / 100000 == 100% -> 10000 == 10%
235      require((fee = _fee) <= FULL_ALLOC / 10, "5");
236  }

Solidity Contracts


Comments to Code: 789 / 1245 =  63 %

JavaScript Tests


Tests to Code: 1810 / 1245 = 145 %