vlzhr/puzzleswap-contracts

PuzzleSwap

Smart contract base for PuzzleSwap.org - Decentralized Exchange built on the Waves blockchain.

The repository contains:

• megapools folder with a megapool script together with layer2 and boostings,
• staking folder with PUZZLE staking service and ultrastaking,
• aggregator folder with aggregator smart contract and REX (SDK to call aggregator onchain),
• limits with limit orders smart contract,
• legacy with unused smart contracts,
• scatches with smart contracts and snippets, which might be used in future.

Special thanks for contributions to:

• deemru
• romalf
• isgeny
• blahdieblah

Telegram chat: t.me/puzzle_network.

puzzleswap-contracts's Issues

Brief audit of `puzzle-custompool.ride`

Only watched swap() function as the most important one:

• LOW. Strange else construction.

  puzzleswap-contracts/puzzle-custompool.ride

  Line 478 in 6297d05

  let feeAssetOutChange = if (newBalanceFeeAsset != unit) then {IntegerEntry("global_"+feeAssetOut.getAssetString()+"_balance", feeAssetOutBalance)} else {StringEntry("hello", "world")}

✅ LOW: No check for payments size == 1.

puzzleswap-contracts/puzzle-custompool.ride

Line 434 in 6297d05

let pmt = i.payments[0].value()

✅ HIGH: Logic flaw. (see below)

puzzleswap-contracts/puzzle-custompool.ride

Line 173 in 6297d05

if (IndexIn == IndexOut) then { AmountIn }

✅ CRITICAL: Unexpected key-value overwrites (same assetId possible as stated above)

puzzleswap-contracts/puzzle-custompool.ride

Lines 483 to 484 in 6297d05

	assetInChange,
	assetOutChange,

✅ MEDIUM: Performance. You should throw() as soon as possible to bypass failed transaction status for a user. Not after your service invoke. The best place is just after let AmountOut = ....

puzzleswap-contracts/puzzle-custompool.ride

Lines 449 to 462 in 6297d05

	let AmountOut = calculateOutAmount(cleanAmountIn, AssetIn, AssetOut, AssetInBalance, AssetOutBalance)
	let feeAmountOut = calculateOutAmount(feeAmountIn, AssetIn, feeAssetOut, AssetInBalance, feeAssetOutBalance)
	# top up protocol fee
	# TODO: top up if feeAsset = PUZZLE
	let creatorFee = fraction(feeAmountOut, 1, 10)
	let protocolFee = fraction(feeAmountOut, 4, 10)
	strict stakingTopUp = reentrantInvoke(Address(base58'3PFTbywqxtFfukX3HyT881g4iW5K4QL3FAS'), "topUpReward", [], [AttachedPayment(feeAssetOut, protocolFee)])
	# do all the verifications
	# TODO: verification that realPrice <= marketPrice (just in case)
	if (AmountOut < minimum) then {
	throw("amount to recieve is lower than given one: " + AmountOut.toString())
	}

✅ MEDIUM: Performance. Same as above.

puzzleswap-contracts/puzzle-custompool.ride

Lines 466 to 467 in 6297d05

	else if (isShutdown()) then {
	throw("contract is on stop")

✅ TRIVIAL: Unused variables.

puzzleswap-contracts/puzzle-custompool.ride

Line 6 in 6297d05

let puzzleAssetId = base58'HEB8Qaw9xrWpWs8tHsiATYGBWDBtP2S7kcPALrMu43AS'

puzzleswap-contracts/puzzle-custompool.ride

Line 438 in 6297d05

let feeAssetIn = AssetIn

✅ HIGH: Wrong calculations. AssetInBalance and feeAssetOutBalance could be changed after first calculateOutAmount(virtual swap happened)

puzzleswap-contracts/puzzle-custompool.ride

Lines 449 to 450 in 6297d05

	let AmountOut = calculateOutAmount(cleanAmountIn, AssetIn, AssetOut, AssetInBalance, AssetOutBalance)
	let feeAmountOut = calculateOutAmount(feeAmountIn, AssetIn, feeAssetOut, AssetInBalance, feeAssetOutBalance)

✅ HIGH: Wrong calculations. If feeAssetOut equals AssetIn or AssetOut (basically one of the assets is USDN) its still MUST be accounted or it will lead to wrong higher interest rates (for USDN).

puzzleswap-contracts/puzzle-custompool.ride

Line 473 in 6297d05

let newBalanceFeeAsset = if (feeAssetOut != AssetIn && feeAssetOut != AssetOut) then {feeAssetOutBalance - feeAmountOut} else {unit}

• HIGH: The main idea of fees in specific asset leads to interest rates for LPs only in this specific asset, other assets will not grow at all. But if it is intended, it is ok, but its still RECOMMENDED to document it for users.