Flayer
FlayerActive
ƒlayer is a liquidity protocol for NFTs with custom Uniswap V4 hook, donate and pool integrations. This audit is to ensure the absolute security in our codebase for the ƒlayer protocol and the Moongate bridge.
Details
Scope
On what chains are the smart contracts going to be deployed?
Flayer
For the purposes of this audit, we will only consider Base as the target network.
Moongate
Ethereum mainnet and any number of EVM-compatible L2 chains.
If you are integrating tokens, are you allowing only whitelisted tokens to work with the codebase or any complying with the standard? Are they assumed to have certain properties, e.g. be non-reentrant? Are there any types of weird tokens you want to integrate?
Flayer
Only support for tokens with the ERC721 standard will be supported for collections. These will be fractionalised into a standardised CollectionToken.
Moongate
ERC721 and ERC1155 tokens will be supported. Additionally, the subset of those tokens that implement ERC-2981 for royalties will gain additional support for claiming.
Are there any limitations on values set by admins (or other roles) in the codebase, including restrictions on array lengths?
Flayer
No expected limitations, it should just be assumed that initialized addresses in the contracts as set correctly.
MoonGate
No expected limitations, it should just be assumed that initialized addresses in the contracts as set correctly.
Are there any limitations on values set by admins (or other roles) in protocols you integrate with, including restrictions on array lengths?
Flayer
We should assume that contract references are set logically and correctly.
It should be assumed that LinearRangeCurve is approved by SudoSwap for usage on their external protocol.
MoonGate
n/a
For permissioned functions, please list all checks and requirements that will be made before calling the function.
The following contracts will be added as LockerManager:
- Listings.sol
- ProtectedListings.sol
- CollectionShutdown.sol
LockerManager(lockerManager).setManager(listings, true);
LockerManager(lockerManager).setManager(protectedListings, true);
LockerManager(lockerManager).setManager(collectionShutdown, true);Is the codebase expected to comply with any EIPs? Can there be/are there any deviations from the specification?
Flayer
The CollectionToken should be strictly compliant with EIP-20
Moongate
The Bridged721 should be strictly compliant with EIP-721 and EIP-2981
The Bridged1155 should be strictly compliant with EIP-1155 and EIP-2981
Are there any off-chain mechanisms or off-chain procedures for the protocol (keeper bots, arbitrage bots, etc.)?
Flayer
No
Moongate
No
Are there any hardcoded values that you intend to change before (some) deployments?
Flayer
For FlayerTokenMigration.sol, the nftxRatio and floorRatio values will change before deployment.
Moongate
No
If the codebase is to be deployed on an L2, what should be the behavior of the protocol in case of sequencer issues (if applicable)? Should Sherlock assume that the Sequencer won't misbehave, including going offline?
Flayer
There shouldn’t be any issue for Flayer as token migration would happen externally to the desired protocol logic. We can assume for this that the Sequencer won’t misbehave or go offline.
Moongate
We would assume that the Sequencer won’t misbehave, but if we can consider the implication of what would happen to bridged assets that are “isolated” on an L2 due to a Sequencer issue.
Should potential issues, like broken assumptions about function behavior, be reported if they could pose risks in future integrations, even if they might not be an issue in the context of the scope? If yes, can you elaborate on properties/invariants that should hold?
Flayer
Responses such as expected fees and tax calculations should be correct for external protocols to utilise. It is also important that each NFT has a correct status. Having tokens that aren’t held by Flayer listed as for sale, protected listings missing, etc. would be detrimental.
Moongate
I don’t think this needs to be checked.
Please discuss any design choices you made.
Flayer
Via the Uniswap V4 hook we capture non-ETH fees and put them into an Internal Swap Pool. This means that LPs won’t receive the token straight away, but it will instead “frontrun” Uniswap swaps later on and convert out internal pool balances to an ETH-equivalent. These are then distributed to LPs in a more beneficial currency via the donate function.
Moongate
When setting and claiming fees migrating to L2, we apply a blanket fee detection against the 0 token ID. This means that more complex royalty setups that vary per token will have a different value blanket royalty applied across all tokens on L2.
Please list any known issues and explicitly state the acceptable risks for each known issue.
Flayer
Previous audits should already be remediated.
Moongate
n/a
We will report issues where the core protocol functionality is inaccessible for at least 7 days. Would you like to override this value?
Flayer
7 days is sufficient
Moongate
7 days is sufficient
Please provide links to previous audits (if any).
Flayer
n/a
Moongate
n/a
Please list any relevant protocol resources.
Flayer
The whitepaper for the protocol:
https://www.flayer.io/whitepaper
Moongate
Built on top of the Optimism bridge. Source files can be found here for reference:
https://github.com/ethereum-optimism/optimism/tree/develop/packages/contracts-bedrock/src
Additional audit information.
Total Rewards
72,500 USDC
Contest Pool
Lead Senior Watson
Judging Pool
Lead Judge
46,500 USDC
18,500 USDC
2,000 USDC
2,500 USDC
Status
Scope
Start Time
End Time
Judging Rules
- +1
Reserved Auditors