Multiplyr - Affine DeFi

Wormhole does not fail if the destination chain ID is different from the one supposed to be. If the rebalancer bot calls this function directly with a different chain ID, it will not fail, so funds during the transactions can be lost.

You can check the Wormhole Chain IDs on each chain, which is not the same as the network chain ID and can be easily confused.

Code Location

WormholeRouter.sol

function _validateWormholeMessageEmitter(IWormhole.VM memory vm) internal view {
    require(vm.emitterAddress == bytes32(uint256(uint160(otherLayerRouter))), "Wrong emitter address");
    require(vm.emitterChainId == otherLayerChainId, "Wrong emitter chain");
    require(vm.nonce >= nextValidNonce, "Old transaction");
}

1. Confuse wormhole chain ID with network chain ID
2. Initialize the contract with a wrong wormhole chain ID
3. Execute transactions on the protocol
4. Validate wormhole message emitter does not work as intended

SOLVED: The Affine DeFi team solved the issue in commit: 06d6bc37fa80f0fdf794a8cb93e8100288d065e0

When setLayerRatios function is used to update the ratio between L1 and L2, an invalid total ratio can be set (more than 100%). Hence, the rebalancer bot could not properly work in those cases.

Code Location

L2Vault.sol

function setLayerRatios(uint256 _l1Ratio, uint256 _l2Ratio) external onlyGovernance {
    l1Ratio = _l1Ratio;
    l2Ratio = _l2Ratio;
}

RISK ACCEPTED: The Affine DeFi team accepted the risk of this finding.

Whenever the exit function is used, the contract should check the token balance before and after the call. So, the exact amount of tokens sent can be properly checked.

Code Location

BridgeEscrow.sol

function l1ClearFund(uint256 amount, bytes calldata exitProof) external {
    require(msg.sender == wormholeRouter, "Only wormhole router");

    // Exit tokens, after that the withdrawn tokens from L2 will be reflected in L1 BridgeEscrow.
    rootChainManager.exit(exitProof);

    // Transfer exited tokens to L1 Vault.
    uint256 balance = token.balanceOf(address(this));
    require(balance >= amount, "Funds not received");

    IL1Vault l1Vault = IL1Vault(vault);
    token.safeTransfer(address(l1Vault), balance);

    l1Vault.afterReceive();
}

SOLVED: The Affine DeFi team solved the issue in commit: 06d6bc37fa80f0fdf794a8cb93e8100288d065e0

Within the _claimAndSellRewards function, the slippage protection of the transaction is set to zero. Hence, if there is tiny liquidity, there is a high risk of losing part of the investment.

Code Location

L1CompoundStrategy.sol

function _claimAndSellRewards() internal {
    comptroller.claimComp(address(this));
    if (rewardToken != address(cToken)) {
        uint256 rewardTokenBalance = balanceOfRewardToken();
        if (rewardTokenBalance >= minRewardToSell) {
            _sellRewardTokenForWant(rewardTokenBalance, 0);
        }
    }
    return;
}

SOLVED: The Affine DeFi team solved the issue in commit: 06d6bc37fa80f0fdf794a8cb93e8100288d065e0

When initializing the wormhole router, the wormhole chain ID can be misused. As can be wrongly set due to confusion with the different deployed chain IDs.

As mentioned on HAL02, you can check the Wormhole Chain IDs on each chain, which is not the same as the network chain ID and can be easily confused.

Code Location

L2WormholeRouter.sol

function initialize(IWormhole _wormhole, L2Vault _vault, address _otherLayerRouter, uint16 _otherLayerChainId)
    external
    initializer
{
    wormhole = _wormhole;
    vault = _vault;
    governance = vault.governance();
    otherLayerRouter = _otherLayerRouter;
    otherLayerChainId = _otherLayerChainId;
}

SOLVED: The Affine DeFi team solved the issue in commit: 06d6bc37fa80f0fdf794a8cb93e8100288d065e0