2-token, fully-autonomous protocol which transitions a fully collateralized
stablecoin (FRAX) to fully algorithmic, moving through a fractionalcollateral phase.

Incorrect version of solidity

Lock solidity version

Example contract from Uniswap used in the project

Redundant array of all proposal ids

Solidity changes used from newer versions than pragma entails

Duplication of code in Uniswap implementation.

Re-entrancy attack on collateral tokens on Frax Pool

Compilation fails on uncommented code for ChainlinkETHUSDPriceConsumer.sol

Never initialized governance variable

Visibility of variables are not specified.

Never used variable 

Mark variables as contants

onlyByOwnerOrGovernance modifier doesn't check governance address

Gas optimization on owner array

Lack of address verification during function call.

Owner array manipulation

General approach to roles within the system

Modifier onlyByOracle() allows timelock_address to perform operation.

FXS contract is still using Comp.sol naming.

Require's reason strings naming doesn't reffer to the project

Reason string not present in require 

Commented code

Missing natspec comments

Usage of literals instead of constant variables

Lack of usage of SafeERC20 from OpenZeppelin

Pool's collateral addresses should be defined as constants

Owner can change FRAX,FXS and Collateral token address after pool is deployed

Reduntant initialization.

Boolean equality

Inefficient greater-than comparison w/ zero

Re-entrancy attack in buyBackFXS() in FraxPool

Potential for overflow

block.number can reach the limit of uint32 

Empty function

Use of if instead of require

Require checks could be simplified

Owner could be set again after team renounces ownership

Oracle address variable not utilized 

Outdated comment

FraxFinance

FraxFinance

Audit History

Security Audit

Solidity, Yul

2020/10/11

2020/11/06