Gondi Invitational

Gondi is a decentralized non-custodial NFT lending protocol engineered to enable the most capital efficient loan primitive and credit market for NFTs.

  • Start date8 Apr 2024
  • End date16 Apr 2024
  • Total awards$74,600 in USDC
  • Duration8 days

Gondi Invitational audit details

  • Total Prize Pool: $74,600 in USDC
    • HM awards: $45,400 in USDC
    • Analysis awards: $2,500 USDC
    • QA awards: $1,300 in USDC
    • Gas awards: $1,300 in USDC
    • Judge awards: $10,460 in USDC
    • Scout awards: $500 in USDC
    • Mitigation Review: $13,140 in USDC (Opportunity goes to top 3 backstage wardens based on placement in this audit who RSVP.)
  • Join C4 Discord to register
  • Submit findings using the C4 form
  • Read our guidelines for more details
  • Starts April 8, 2024 20:00 UTC
  • Ends April 16, 2024 20:00 UTC

This is a Private audit

This audit repo and its Discord channel are accessible to certified wardens only. Participation in private audits is bound by:

  1. Code4rena's Certified Contributor Terms and Conditions
  2. C4's Certified Contributor Code of Professional Conduct

All discussions regarding private audits should be considered private and confidential, unless otherwise indicated.

Automated Findings / Publicly Known Issues

The 4naly3er report can be found here.

Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.

If the owner of the pool or PoolUnderwriter are compromised, then pools could be drained by setting underwriting terms against worthless NFTs.
The security of those wallets is in a separate layer (multi-sig / governor contract) and should not be considered.

Overview

Gondi is a decentralized non-custodial NFT lending protocol that offers the most flexible and capital efficient primitive.
Gondi loans allows borrowers to access liquidity and obtain the best marginal rate when available as well as allow lenders to earn yield on their capital with the flexibility of entering and exiting their position any moment without affecting borrowers' loans.
Gondi V3 loan offers are submitted from both protocol pools as well as peers market participants creating deep liquidity as well as precise risk pricing..

Links

Scope

See scope.txt

Files in scope

FileLogic ContractsLinesnLinesSLOC
/src/lib/AddressManager.sol110010061
/src/lib/AuctionLoanLiquidator.sol1336321241
/src/lib/AuctionWithBuyoutLoanLiquidator.sol113312493
/src/lib/InputChecker.sol115159
/src/lib/LiquidationDistributor.sol1123111106
/src/lib/LiquidationHandler.sol111511277
/src/lib/Multicall.sol1222215
/src/lib/UserVault.sol1376355271
/src/lib/callbacks/CallbackHandler.sol1847553
/src/lib/callbacks/PurchaseBundler.sol1320308247
/src/lib/loans/BaseLoan.sol1216216117
/src/lib/loans/BaseLoanHelpers.sol1392325
/src/lib/loans/LoanManager.sol1161136105
/src/lib/loans/LoanManagerRegistry.sol1313120
/src/lib/loans/MultiSourceLoan.sol111551058864
/src/lib/loans/WithLoanManagers.sol1292919
/src/lib/pools/AaveUsdcBaseInterestAllocator.sol110510575
/src/lib/pools/FeeManager.sol1797951
/src/lib/pools/LidoEthBaseInterestAllocator.sol1173173134
/src/lib/pools/Pool.sol1766731507
/src/lib/pools/PoolOfferHandler.sol1170155114
/src/lib/pools/WithdrawalQueue.sol114514582
/src/lib/utils/BytesLib.sol1959550
/src/lib/utils/Hash.sol1200196169
/src/lib/utils/Interest.sol1393930
/src/lib/utils/TwoStepOwned.sol1484831
/src/lib/utils/ValidatorHelpers.sol1827949
/src/lib/utils/WithProtocolFee.sol1868654
Totals28524349673669

Files out of scope

See out_of_scope.txt

Scoping Q & A

General questions

QuestionAnswer
ERC20 used by the protocolUSDC / WETH
Test coverage77.11%
ERC721 used by the protocol🖊️
Chains the protocol will be deployed onEthereum

ERC20 token behaviors in scope

External integrations (e.g., Uniswap) behavior in scope

QuestionAnswer
Enabling/disabling fees (e.g. Blur disables/enables fees)No
Pausability (e.g. Uniswap pool gets paused)No
Upgradeability (e.g. Uniswap gets upgraded)No

Additional context

Main invariants

  • While a loan is outstanding, MultiSourceLoan must own the collateral.

Attack ideas (where to focus for bugs)

Security of collateral in MultiSourceLoan.
Pool accounting and potential exploits.

All trusted roles in the protocol

RoleDescription
Owner of PoolThis will be a Governor contract that will update the PoolUnderwriter/base rate strategy.

Running tests

git clone --recurse https://github.com/code-423n4/2024-04-gondi
git submodule update --init --recursive

To run code coverage

forge coverage --ir-minimum

To run gas benchmarks

forge test --gas-report

To run Slither (See slither.txt)

slither .

Gas report: See gas-report.txt

Test coverage:

Miscellaneous

Employees for Gondi and employees' family members are ineligible to participate in this audit.