Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create sUSDS Rate Provider on Base #254

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions rate-providers/registry.json
Original file line number Diff line number Diff line change
Expand Up @@ -911,6 +911,20 @@
"warnings": [],
"factory": "",
"upgradeableComponents": []
},
"0x84394fa6a39bdff63b255622da362b113c690267": {
"asset": "0x5875eEE11Cf8398102FdAd704C9E96607675467a",
"name": "SavingsUSDSRateProvider",
"summary": "safe",
"review": "./sUSDSBaseRateProvider.md",
"warnings": [],
"factory": "",
"upgradeableComponents": [
{
"entrypoint": "0xa3931d71877C0E7a3148CB7Eb4463524FEc27fbD",
"implementationReviewed": "0x4e7991e5C547ce825BdEb665EE14a3274f9F61e0"
}
]
}
},
"ethereum": {
Expand Down
49 changes: 49 additions & 0 deletions rate-providers/sUSDSBaseRateProvider.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,49 @@
# Rate Provider: `SavingsUSDSRateProvider`

## Details
- Reviewed by: @mkflow27
- Checked by: @\<GitHub handle of secondary reviewer\>
- Deployed at:
- [base:0x84394fa6a39bdff63b255622da362b113c690267](https://basescan.org/address/0x84394fa6a39bdff63b255622da362b113c690267#code)
- Audit report(s):
- [Chainsecurity audit](https://docs.spark.fi/assets/Chainsecurity-sUSDS.pdf)

## Context
This rate Provider is providing a bridged rate from the L1 sUSDS contract. It briges the rate (`chi`) via the Base message bridge.

## Review Checklist: Bare Minimum Compatibility
Each of the items below represents an absolute requirement for the Rate Provider. If any of these is unchecked, the Rate Provider is unfit to use.

- [x] Implements the [`IRateProvider`](https://github.com/balancer/balancer-v2-monorepo/blob/bc3b3fee6e13e01d2efe610ed8118fdb74dfc1f2/pkg/interfaces/contracts/pool-utils/IRateProvider.sol) interface.
- [x] `getRate` returns an 18-decimal fixed point number (i.e., 1 == 1e18) regardless of underlying token decimals.

## Review Checklist: Common Findings
Each of the items below represents a common red flag found in Rate Provider contracts.

If none of these is checked, then this might be a pretty great Rate Provider! If any of these is checked, we must thoroughly elaborate on the conditions that lead to the potential issue. Decision points are not binary; a Rate Provider can be safe despite these boxes being checked. A check simply indicates that thorough vetting is required in a specific area, and this vetting should be used to inform a holistic analysis of the Rate Provider.

### Administrative Privileges
- [ ] The Rate Provider is upgradeable (e.g., via a proxy architecture or an `onlyOwner` function that updates the price source address).

- [x] Some other portion of the price pipeline is upgradeable (e.g., the token itself, an oracle, or some piece of a larger system that tracks the price).
- upgradeable component: `SUsds` ([ethereum:0xa3931d71877C0E7a3148CB7Eb4463524FEc27fbD](https://etherscan.io/address/0xa3931d71877C0E7a3148CB7Eb4463524FEc27fbD#readProxyContract))
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How did you get to these L1 addresses?

- admin address: [ethereum:0xbe8e3e3618f7474f8cb1d074a26affef007e98fb](https://etherscan.io/address/0xbe8e3e3618f7474f8cb1d074a26affef007e98fb#code)
- admin type: Spark governance


### Oracles
- [ ] Price data is provided by an off-chain source (e.g., a Chainlink oracle, a multisig, or a network of nodes).

- [ ] Price data is expected to be volatile (e.g., because it represents an open market price instead of a (mostly) monotonically increasing price).

### Common Manipulation Vectors
- [ ] The Rate Provider is susceptible to donation attacks.

## Additional Findings
To save time, we do not bother pointing out low-severity/informational issues or gas optimizations (unless the gas usage is particularly egregious). Instead, we focus only on high- and medium-severity findings which materially impact the contract's functionality and could harm users.


## Conclusion
**Summary judgment: USABLE**
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we start using USABLE/UNUSABLE instead of SAFE/UNSAFE?


The reviewed rate provider should work well with Balancer pools. It works based on a bridged rate from the L1 sUSDS contract.