Manual Review

A thorough line-by-line review was conducted on the codebase to identify potential malfunctions and vulnerabilities in Vendor Finance's lending pool system.

As the project at hand implements a lending pool, intricate care was put into ensuring that the flow of funds within the system conforms to the specifications and restrictions laid forth within the protocol's specification.

We validated that all state transitions of the system occur within sane criteria and that all rudimentary formulas within the system execute as expected. We pinpointed several price-related issues within the system's lending pool implementation which could have had severe ramifications to its overall operation, however, they were conveyed ahead of time to the Vendor Finance team to be promptly remediated.

Additionally, the system was investigated for any other commonly present attack vectors such as re-entrancy attacks, mathematical truncations, logical flaws and ERC / EIP standard inconsistencies. The documentation of the project was satisfactory to a certain extent, however, we strongly recommend it to be expanded at certain complex points such as the reimbursement rate of debt rollovers as well as to be corrected across the board as multiple typographic errors were identified during the code's review.

A total of 27 findings were identified over the course of the manual review of which 17 findings concerned the behaviour and security of the system. The non-security related findings, such as optimizations, are included in the separate Code Style chapter.

The finding table below enumerates all these security / behavioural findings:

ID	Severity	Addressed	Title
INI-01M			Outdated & Vulnerable Initializer Implementation
LPI-01M			Potentially Incorrect Reimbursement Calculation
LPI-02M			Ill-Advised Toggle Pattern
LPI-03M			Inefficient & Restrictive Decimal Normalizations
LPI-04M			Truncation of Collateral / Lending Conversion
LPI-05M			Improper Validation of Price
VFM-01M			Potentially Improper Access Control
VFM-02M			Potentially Unsafe Casting Operation
VLE-01M			Inconsistent Input Validation
VLE-02M			Inexistent Input Validation
VLE-03M			Inexistent Conformity to Checks Effects Interactions Pattern
VOE-01M			Centralized Control of Price Reported
VPF-01M			Inexistent Prevention of Equal Asset Pool Creation
VPF-02M			Ill-Advised Toggle Pattern
VPF-03M			Improper Pausability Role Control
VPF-04M			Potentially Improper Discount Deduction
VPF-05M			Potentially Incorrect State Enforcement