• Total Prize Pool: $40,000 in USDC
  • HM awards: $31,875 in USDC
  • QA awards: $1,325 in USDC
  • Judge awards: $3,300 in USDC
  • Validator awards: $3,000 USDC
  • Scout awards: $500 USDC
• Join C4 Discord to register
• Submit findings using the C4 form
• Read our guidelines for more details
• Starts June 24, 2024 20:00 UTC
• Ends July 8, 2024 20:00 UTC

The 4naly3er report can be found here.

Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.

• Rounding error from (stETH/wstETH) conversion
• Owner is TechOps multisig
• We did not add ERC20 Permits, we could add them later
• We assume the user will chose the correct external function based on their collateral type (ETH/WETH/stETH/wstETH)
• DEX is hardcoded and will either be 0x or 1Inch
• A user is expected to rationally chose between normal zap router and leverage zap router

Route between different zaps and functionality.

• One-click Leverage: use flash loans via leverage macro to lever loop in one action
• Flippening: a wrapper on leverage where you sell the final eBTC for more stETH (lever long ETH)
• Native ETH: Deposit from native ETH and auto-wrap into stETH
• ETH Variants deposits: come from WETH and wstETH as well for convenience

• Previous audits: https://gist.github.com/GalloDaSballo/4e345cec4e3aef9682f320149b3027aa
• Documentation: https://github.com/ebtc-protocol/ebtc-zap-router/blob/main/README.md
• Website: https://badger.com/
• X/Twitter: https://twitter.com/badgerdao
• Discord: https://discord.gg/badgerdao

All files not in the scope table are Out Of Scope

N/A

• Position manager permit needs to be revoked after each operation
• ZapRouter contract should not hold any CDP positions
• ZapRouter contract should not have any tokens after each operation (aside from rounding)

• Fee should be assessed only when debt increases
• Owner cannot execute arbitrary calls

N/A

Clone the repo;

git clone --recurse https://github.com/code-423n4/2024-06-badger.git

For ebtc-protocol tests (Both for Hardhat and Foundry);

cd ebtc-protocol
yarn
cd packages/contracts

For ebtc-protocol Hardhat tests:

yarn test

For ebtc-protocol Foundry tests:

forge test

For ebtc-protocol test coverage:

forge coverage

For ebtc-zap-router tests;

cd ebtc-zap-router
forge install
cd lib/ebtc
yarn
cd ../../
forge build
forge test

For ebtc-zap-router test coverage:

forge coverage

Employees of Badger and employees' family members are ineligible to participate in this audit.