Skip to content

Conversation

@cupOJoseph
Copy link
Member

No description provided.

@octane-security-app
Copy link

Summary by Octane

New Contracts

  • page.tsx: The provided code does not include a .sol smart contract file but is a JavaScript/React component for rendering a TroveExplorerScreen.
  • TroveExplorerScreen.tsx: The provided code is a React component for managing and displaying paginated, sortable active Troves in the Liquity V2 protocol.
  • TroveRow.tsx: Displays trove details with collateral, borrowed amount, liquidation price, LTV, interest rate, and borrower address.
  • TroveTable.tsx: The code displays and sorts trove data in a table with a loading state and sorting options for various fields.

Updated Contracts

  • TopBar.tsx: Added "troves" menu item with an IconSearch to the smart contract's navigation.
  • content.tsx: The smart contract now includes a new "Troves" feature alongside existing functions like Dashboard, Borrow, Multiply, Earn, and Stake.
  • subgraph-hooks.ts: Added support for querying and mapping active troves into an explorer item format for streamlined data handling.
  • subgraph-queries.ts: Added a query to fetch all active troves with sorting and pagination options.
  • types.ts: The modification adds a TroveExplorerItem type, introducing a structure for trove details, including collateral info, rates, and timestamps.

🔗 Commit Hash: d7fc880

@octane-security-app
Copy link

Overview

Vulnerabilities found: 10                                                                                
Warnings found: 2                                                                                

Detailed findings

frontend/app/src/screens/TroveExplorerScreen/TroveExplorerScreen.tsx

  • Sentinel-based pagination check (troves.length === pageSize) in TroveExplorerScreen causes empty last-page navigation. See more
  • Error masking in Trove Explorer frontend causes misleading 'No active troves found'. See more

frontend/app/src/screens/TroveExplorerScreen/TroveRow.tsx

  • Unsafe collateral symbol handling in Trove Explorer rendering causes route-level DoS. See more
  • Missing named export (useCollPrice) import in TroveRow.tsx causes Troves page build/runtime failure. See more

frontend/app/src/subgraph-hooks.ts

  • Using subgraph recorded debt without pending interest in Trove Explorer calculations causes understated LTV and liquidation price. See more
  • BigInt scalar parsing mismatch in Trove Explorer subgraph mapping causes route-level UI crash/DoS. See more
  • Offset (skip-based) pagination in Trove Explorer causes misleading empty results and pagination lock at scale. See more
  • Non-deterministic skip-based pagination in Trove Explorer subgraph hook causes duplicate/missing troves across pages. See more
  • Hard-throwing subgraph mapping and invalid sort field in Trove Explorer causes persistent read-only view DoS. See more

frontend/app/src/subgraph-queries.ts

  • Inconsistent interest rate source in Trove Explorer mapping causes misdisplay and incorrect sorting. See more

Warnings

contracts/src/Zappers/Modules/Exchanges/UniswapV3/UniPriceConverter.sol

  • Off-by-one branch condition in UniPriceConverter.priceToSqrtPriceX96 at _price == 2^64 causes zero sqrt price (potential pool init revert). See more

frontend/app/src/screens/TroveExplorerScreen/TroveRow.tsx

  • Inconsistent token label in Trove Explorer UI causes user confusion and minor missteps. See more

🔗 Commit Hash: d7fc880
🛡️ Octane Dashboard: All vulnerabilities

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants