feat: tests for the rebalancer with flashloan · AngleProtocol/angle-transmuter@77a8166 · GitHub

GitHub Advanced Security / Slither succeeded Mar 25, 2024 in 2s

4 new alerts including 1 medium severity security vulnerability

New alerts in code changed by this pull request

Security Alerts:

1 medium
3 low

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 54 in contracts/helpers/RebalancerFlashloan.sol

Code scanning / Slither

Unused return Medium

RebalancerFlashloan.adjustYieldExposure(uint256,uint8) ignores return value by FLASHLOAN.flashLoan(IERC3156FlashBorrower(address(this)),address(AGTOKEN),amountStablecoins,abi.encode(increase))

Check notice on line 100 in contracts/helpers/RebalancerFlashloan.sol

Code scanning / Slither

Reentrancy vulnerabilities Low

Reentrancy in RebalancerFlashloan.onFlashLoan(address,address,uint256,uint256,bytes):
External calls:
- amountOut = TRANSMUTER.swapExactInput(amount,0,AGTOKEN,tokenOut,address(this),block.timestamp)
- amountOut = VAULT.deposit(amountOut,address(this))
- amountOut = VAULT.redeem(amountOut,address(this),address(this))
- IERC20(tokenIn).safeIncreaseAllowance(address(TRANSMUTER),type()(uint256).max - allowance)
- amountStableOut = TRANSMUTER.swapExactInput(amountOut,0,tokenIn,AGTOKEN,address(this),block.timestamp)
State variables written after the call(s):
- budget -= subsidy
- orders[tokenIn][tokenOut].subsidyBudget -= subsidy.toUint112()

Check notice on line 100 in contracts/helpers/RebalancerFlashloan.sol

Code scanning / Slither

Reentrancy vulnerabilities Low

Reentrancy in RebalancerFlashloan.onFlashLoan(address,address,uint256,uint256,bytes):
External calls:
- amountOut = TRANSMUTER.swapExactInput(amount,0,AGTOKEN,tokenOut,address(this),block.timestamp)
- amountOut = VAULT.deposit(amountOut,address(this))
- amountOut = VAULT.redeem(amountOut,address(this),address(this))
- IERC20(tokenIn).safeIncreaseAllowance(address(TRANSMUTER),type()(uint256).max - allowance)
- amountStableOut = TRANSMUTER.swapExactInput(amountOut,0,tokenIn,AGTOKEN,address(this),block.timestamp)
Event emitted after the call(s):
- SubsidyPaid(tokenIn,tokenOut,subsidy)

Check notice on line 100 in contracts/helpers/RebalancerFlashloan.sol

Code scanning / Slither

Block timestamp Low

RebalancerFlashloan.onFlashLoan(address,address,uint256,uint256,bytes) uses timestamp for comparisons
Dangerous comparisons:
- amount > amountStableOut