Risks
Last updated
Was this helpful?
Most contracts use the UUPSUpgradeable pattern. Mistakes during upgrades can lead to data loss or funds being locked.
Many functions are protected by the onlyOwner modifier, concentrating power in a single address. If the owner's private key is compromised, an attacker could control all critical functions: changing parameters, withdrawing funds, or upgrading contracts.
The protocol relies on third-party contracts (Aave, Chainlink, Uniswap, LayerZero, Arbitrum bridges). Vulnerabilities, upgrades, or failures in these dependencies can lead to loss of funds or protocol downtime.
The ChainLinkDataConsumer contract fetches prices via Chainlink. If the oracle is compromised or becomes unavailable, the protocol may use incorrect data, leading to faulty calculations, loss of funds, or attacks on protocol solvency.
The use of SafeERC20 and TransferHelper reduces, but does not eliminate, risks associated with non-standard token implementations (e.g., re-entrancy attacks, unexpected behavior). Errors in transfer logic can result in loss of funds.
Contracts like L1SenderV2 and L2TokenReceiverV2 interact with bridges and cross-chain messaging. This is a complex area where attacks on bridges, message delays, duplication, or loss can lead to funds being lost or locked.
Centralized control over key parameters (oracles, pools, bridges) creates a single point of failure and the potential for abuse.
Last updated
Was this helpful?
Was this helpful?