{"componentChunkName":"component---node-modules-rocketseat-gatsby-theme-docs-core-src-templates-docs-query-js","path":"/manual-review","result":{"data":{"mdx":{"id":"6dc1c4ae-aa89-5c1f-ae2c-b5c40f0c46e8","excerpt":"A  thorough line-by-line review  was conducted on the codebase to identify potential malfunctions and vulnerabilities in Ultra Yield's vault implementations. As…","fields":{"slug":"/manual-review/"},"frontmatter":{"title":"Manual Review","description":"Briefly describes the output of the manual review of the project.","image":null,"disableTableOfContents":null},"body":"var _excluded = [\"components\"];\n\nfunction _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsxRuntime classic */\n\n/* @jsx mdx */\nvar _frontmatter = {\n  \"title\": \"Manual Review\",\n  \"description\": \"Briefly describes the output of the manual review of the project.\"\n};\nvar layoutProps = {\n  _frontmatter: _frontmatter\n};\nvar MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  var components = _ref.components,\n      props = _objectWithoutProperties(_ref, _excluded);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"p\", null, \"A \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"thorough line-by-line review\"), \" was conducted on the codebase to identify potential malfunctions and vulnerabilities in Ultra Yield's vault implementations.\"), mdx(\"p\", null, \"As the project at hand implements an EIP-4626 vault system, intricate care was put into ensuring that the \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"flow of funds within the system conforms to the specifications and restrictions\"), \" laid forth within the protocol's specification.\"), mdx(\"p\", null, \"We validated that \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"all state transitions of the system occur within sane criteria\"), \" and that all rudimentary formulas within the system execute as expected. We \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"pinpointed a significant dilution vulnerability\"), \" within the system which could have had \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"moderate ramifications\"), \" to all new depositors in the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"UltraVault\"), \" system; for more information, kindly consult the relevant medium-severity exhibit of the contract within the report.\"), mdx(\"p\", null, \"Additionally, the system was investigated for any other commonly present attack vectors such as re-entrancy attacks, mathematical truncations, logical flaws and \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://eips.ethereum.org/\"\n  }, \"ERC / EIP\"), \" standard inconsistencies. The documentation of the project was satisfactory to the extent it need be.\"), mdx(\"p\", null, \"A total of \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"29 findings\"), \" were identified over the course of the manual review of which \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"9 findings\"), \" concerned the behaviour and security of the system. The non-security related findings, such as optimizations, are included in the separate \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"/reports/ultra-yield-vault-contracts-68aaf30fb32fb20018fa5e24/code-style\"\n  }, \"Code Style\"), \" chapter.\"), mdx(\"p\", null, \"The finding table below enumerates all these security / behavioural findings:\"), mdx(\"table\", null, mdx(\"thead\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"thead\"\n  }, mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"ID\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Severity\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Addressed\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Title\"))), mdx(\"tbody\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/ultra-yield-vault-contracts-68aaf30fb32fb20018fa5e24/manual-review/BaseControlledAsyncRedeem-BCA#BCA-01M\"\n  }, \"BCA-01M\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-informational\",\n    \"src\": \"https://omniscia.io/report-assets/informational.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-fixed o-yes\",\n    \"src\": \"https://omniscia.io/report-assets/yes.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Incompatibility of System with EIP-777 Assets\")), mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/ultra-yield-vault-contracts-68aaf30fb32fb20018fa5e24/manual-review/BaseControlledAsyncRedeem-BCA#BCA-02M\"\n  }, \"BCA-02M\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-minor\",\n    \"src\": \"https://omniscia.io/report-assets/minor.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-fixed o-acknowledged\",\n    \"src\": \"https://omniscia.io/report-assets/acknowledged.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Improper Accounting Error Drift\")), mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/ultra-yield-vault-contracts-68aaf30fb32fb20018fa5e24/manual-review/BaseControlledAsyncRedeem-BCA#BCA-03M\"\n  }, \"BCA-03M\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-minor\",\n    \"src\": \"https://omniscia.io/report-assets/minor.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-fixed o-yes\",\n    \"src\": \"https://omniscia.io/report-assets/yes.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Incorrect Event Emission\")), mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/ultra-yield-vault-contracts-68aaf30fb32fb20018fa5e24/manual-review/BaseControlledAsyncRedeem-BCA#BCA-04M\"\n  }, \"BCA-04M\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-medium\",\n    \"src\": \"https://omniscia.io/report-assets/medium.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-fixed o-yes\",\n    \"src\": \"https://omniscia.io/report-assets/yes.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Non-Standard Event Emission\")), mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/ultra-yield-vault-contracts-68aaf30fb32fb20018fa5e24/manual-review/UltraFeeder-UFR#UFR-01M\"\n  }, \"UFR-01M\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-informational\",\n    \"src\": \"https://omniscia.io/report-assets/informational.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-fixed o-acknowledged\",\n    \"src\": \"https://omniscia.io/report-assets/acknowledged.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Inefficient Redemption Fulfilment Structure\")), mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/ultra-yield-vault-contracts-68aaf30fb32fb20018fa5e24/manual-review/UltraVault-UVT#UVT-01M\"\n  }, \"UVT-01M\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-medium\",\n    \"src\": \"https://omniscia.io/report-assets/medium.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-fixed o-yes\",\n    \"src\": \"https://omniscia.io/report-assets/yes.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Insecure Integration of Parent Dependency\")), mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/ultra-yield-vault-contracts-68aaf30fb32fb20018fa5e24/manual-review/UltraVaultOracle-UVO#UVO-01M\"\n  }, \"UVO-01M\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-minor\",\n    \"src\": \"https://omniscia.io/report-assets/minor.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-fixed o-yes\",\n    \"src\": \"https://omniscia.io/report-assets/yes.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Inefficient & Error-Prone Vesting System\")), mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/ultra-yield-vault-contracts-68aaf30fb32fb20018fa5e24/manual-review/UltraVaultRateProvider-UVR#UVR-01M\"\n  }, \"UVR-01M\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-minor\",\n    \"src\": \"https://omniscia.io/report-assets/minor.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-fixed o-yes\",\n    \"src\": \"https://omniscia.io/report-assets/yes.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Inexistent Restriction of Decimals\")), mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/ultra-yield-vault-contracts-68aaf30fb32fb20018fa5e24/manual-review/VaultPriceManager-VPM#VPM-01M\"\n  }, \"VPM-01M\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-medium\",\n    \"src\": \"https://omniscia.io/report-assets/medium.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-fixed o-acknowledged\",\n    \"src\": \"https://omniscia.io/report-assets/acknowledged.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Potentially Incorrect Restriction of Price Movements\")))));\n}\n;\nMDXContent.isMDXComponent = true;","headings":[]}},"pageContext":{"slug":"/manual-review/","prev":{"label":"Static Analysis","link":"/static-analysis"},"next":{"label":"Code Style","link":"/code-style"}}},"staticQueryHashes":["1954253342","2328931024","2501019404","973074209"]}