Manual Review

A thorough line-by-line review was conducted on the codebase to identify potential malfunctions and vulnerabilities in Steer Protocol's core implementation.

As the project at hand implements multiple protocol implementations, intricate care was put into ensuring that the flow of funds & assets within the system conforms to the specifications and restrictions laid forth within the protocol's specification.

We validated that all state transitions of the system occur within sane criteria and that all rudimentary formulas within the system execute as expected. We pinpointed multiple vulnerabilities of all severities within the system which could have had moderate-to-severe ramifications to its overall operation, however, some were conveyed ahead of time to the Steer Protocol team to be promptly evaluated and remediated.

Additionally, the system was investigated for any other commonly present attack vectors such as re-entrancy attacks, mathematical truncations, logical flaws and ERC / EIP standard inconsistencies. The documentation of the project was satisfactory to a certain extent, however, we strongly recommend it to be expanded at certain complex points such as the positional vault systems integrating with Uniswap V3.

A total of 66 findings were identified over the course of the manual review of which 43 findings concerned the behaviour and security of the system. The non-security related findings, such as optimizations, are included in the separate Code Style chapter.

The finding table below enumerates all these security / behavioural findings:

ID	Severity	Addressed	Title
BLM-01M			Inexistent Initialization of Base Implementation
BMR-01M			Inexistent Initialization of Access Control / Ownable
BMR-02M			Inexistent Initialization of Base Implementation
BMR-03M			Insufficient Data Deletion
BRY-01M			Inexistent Initialization of Base Implementation
BRY-02M			Weak Validation of IPFS CIDv0
DJS-01M			Inexistent Initialization of Base Implementation
GVT-01M			Inexistent Initialization of Base Implementation
IGE-01M			Logic Upgrade w/o Governance Approval
IGE-02M			Abnormally Small Voting Delay
KRY-01M			Inexistent Initialization of Base Implementation
KRY-02M			Inexistent Sanitization of joiners
KRY-03M			Improper Keeper Removal Methodology
MPL-01M			Inverse Check Application
MPL-02M			Weak Relative Weight Evaluation
MPL-03M			Inexistent Sanitization of Position Validity
ORO-01M			Inexistent Initialization of Base Implementation
ORO-02M			Improper Bitwise Operation
ORO-03M			Inexistent Prevention of Re-Entrancy
ORO-04M			Action Hash Conflict
ORO-05M			Inexistent Protection of Target Address
SPL-01M			Unprotected Inversion of Swap Amount
SPL-02M			Inverse Check Application
SRS-01M			Inexistent Initialization of Base Implementation
SRS-02M			Potentially Insecure Accounting System
SRS-03M			Inexistent Validation of Pool Initialization
SRS-04M			Improper Overwrite of Pending Rewards
SGE-01M			Logic Upgrade w/o Governance Approval
SGE-02M			Inexistent Access Control of Internal Governance
SGE-03M			Abnormally Small Voting Delay
SPY-01M			Inexistent Initialization of Base Implementation
SPY-02M			Inexistent Clearance of Approvals
STN-01M			Arbitrary Mint Capacity
STN-02M			Inexistent Initialization of Base Implementation
STN-03M			Potentially Incompatible Flash Loan Mechanism
SRY-01M			Inexistent Initialization of Base Implementation
SRY-02M			Inexistent Sanitization of Max Gas
SRY-03M			Inexistent Validation of execBundle Validity
SRY-04M			Arbitrary Burn Functionality
TVR-01M			Improper Change of Recipient
TVR-02M			Inexistent Guarantee of Vested Funds
VRY-01M			Inexistent Initialization of Base Implementation
WRY-01M			Inexistent Manager Deletion Workflow