fraxfinance / frax-solidity Goto Github PK

Hi guys,

I am really impressed of the FPI project since it's stablecoin peg to off-chain inflation data, and I would like to have a better understanding on how it works exactly; I mean, how do you force the peg ?

I looked at your code, and the only reference of the CPITrackerOracle is in the FPIControllerPool. It seems that you compute the absolute relative distance between FPI and CPI values. This distance is then used in calcMintFPI and calcRedeemFPI methods, and it's used to generate an error if the FPI value is out-of-bounds. In my opinion, this is not a peg mecanism since it seems to block both the mint and redeem.

That's why I wonder where the peg mecanism happens ? Maybe it's in FPIControllerPool and I misunderstood something idk.

Thank you for those who will take the time to answer me.

... and 🎅🏻 🎄 Merry Christmas 🎄 🎅🏻 !!

Hey guys, I've got some questions regarding the FraxPoolV3, not a pro with the Frax protocol so bear with me :)

There is the FraxPoolV3 where users can mint/redeem FRAX tokens in exchange for collateral and FXS tokens. The FraxPoolV3 also helps to maintain the FRAX's USD peg because when collateral/FRAX price fluctuates there is an arb opportunity to mint/redeem FRAX for exactly 1 USD of collateral tokens.

The thing is that collateral token prices also fluctuate so at some point in time the pool becomes insolvent when amount of collateral tokens is not enough for redeeming FRAX hence this line was introduced to prevent redeeming at all.

There is the setCollateralPrice() method responsible for setting collateral prices but I've checked the production pool's transactions and that method has never been called which means that all collateral prices have been set to 1.00 USD since the contract deployment and have never been updated.

I've found some related issues which state that USD-pegged assets should not be considered equal to 1.00 USD at all times:

• code-423n4/2022-12-tigris-findings#462
• code-423n4/2022-09-canto-findings#73

So questions are:

1. Is it ok that at some points in time the pool is not solvent? I guess the Frax protocol thinks of it to be ok and simply waits while arbitrageurs make collateral/FRAX price even because in the end all Frax pool collateral tokens are USD-pegged.
2. Is it enough to set collateral token price to 1.00 and never update it (assuming that all collateral tokens are USD-pegged) to maintain the FRAX USD peg?
3. If a collateral token price is dropped heavily and FRAX price is less than redeem_price_threshold then what's the point of redeeming FRAX if in return user gets less value in collateral tokens? I mean in this case the redemption mechanism seems to be broken and FRAX USD peg can not be maintained anymore because there is no sense for end users to redeem (i.e. burn) FRAX tokens.

Thanks in advance

In FraxPool.sol L242, L274-275, L296, there is an extra approve() which is not necessary for transferring the tokens back to the redeemer in collectRedemption(). This bug has been reported by @samczsun.

Link to bug:

Frax.sol：
frax_price() instructions X FRAX = 1 USD. in 151 line.
fxs_price() instructions X FXS = 1 USD. in 156 line.
Should be 1 FRAX = X USD, 1 FXS = X USD.
I am looking for frax and hope to hear back.

All other frax tokens appear to support permit() except for the OG on mainnet, thus there is no ferrying with signatures allowed.

The FXS contract here: https://github.com/FraxFinance/frax-solidity/blob/master/contracts/FXS/FXS.sol

Does not implement the optional ERC20 property name()

While it is optional, many applications depend on: just one example is Uniswap, and as a consequence the FXS token will not be able to be added as a custom token by Uniswap users.

I found an unused mapping here:

Trying to better understand the total FRAX supply numbers.

The totalSupply number on frax.finance shows that of ETH mainnet. Does this supply take into account the canonical native tokens from other chains?

If my understanding is correct, the totalSupply on ETH mainnet accounts for the bridged, but not the canonical on other chains. So the total FRAX in circulation is actually the sum of canonical values across chains.

Am I missing something here?

What is the init code hash of fraxswap?

The url "https://app.frax.finance/privacy" opening in the Mac looks not good by safari. Repair it please.

If my suggestion is helpful for the project,give me some FXS.Thank you.
my wallet: 0x6438057CE2Bc8f201b2eb3594b6BD7D19171504A

Hi, we recently have conducted a systematic study about Solidity event usage, evolution, and impact, and we are attempting to build a tool to improve the practice of Solidity event use based on our findings. We have tried our prototype tool on some of the most popular GitHub Solidity repositories, and for your repository, we find a potential optimization of gas consumption arisen from event use.

The point is that when we use emit operation to store the value of a certain variable, local memory type variable would be preferable to global storage type (state) variable if they hold the same value. The reason is that an extra SLOAD operation would be needed to access the variable if it is storage type, and the SLOAD operation costs 800 gas.

For your repository, we find that the following event use can be improved:

• FraxUniV3Farm_V2.sol
  function name: setMultipliers
  event name:  MaxVeFXSMultiplier  
          LockedStakeMaxMultiplierUpdated  
          veFXSPerFraxForMaxBoostUpdated  
          veFXSBoostScaleFactor
  variable:    vefxs_max_multiplier->_vefxs_max_multiplier  
          lock_max_multiplier->_lock_max_multiplier  
          vefxs_per_frax_for_max_boost->_vefxs_per_frax_for_max_boost  
          vefxs_boost_scale_factor->_vefxs_boost_scale_factor

    function setMultipliers(
        uint256 _lock_max_multiplier, 
        uint256 _vefxs_max_multiplier, 
        uint256 _vefxs_per_frax_for_max_boost,
        uint256 _vefxs_boost_scale_factor
    ) external onlyByOwnGov {
        require(_lock_max_multiplier >= MULTIPLIER_PRECISION, "Mult must be >= MULTIPLIER_PRECISION");
        require(_vefxs_max_multiplier >= 0, "veFXS mul must be >= 0");
        require(_vefxs_per_frax_for_max_boost > 0, "veFXS pct max must be >= 0");
        require(_vefxs_boost_scale_factor > 0, "veFXS boost scale factor must be >= 0");

        lock_max_multiplier = _lock_max_multiplier;
        vefxs_max_multiplier = _vefxs_max_multiplier;
        vefxs_per_frax_for_max_boost = _vefxs_per_frax_for_max_boost;
        vefxs_boost_scale_factor = _vefxs_boost_scale_factor;

        emit MaxVeFXSMultiplier(vefxs_max_multiplier);
        emit LockedStakeMaxMultiplierUpdated(lock_max_multiplier);
        emit veFXSPerFraxForMaxBoostUpdated(vefxs_per_frax_for_max_boost);
        emit veFXSBoostScaleFactor(vefxs_boost_scale_factor);
    }

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

    function setLockedStakeTimeForMinAndMaxMultiplier(uint256 _lock_time_for_max_multiplier, uint256 _lock_time_min) external onlyByOwnGov {
        require(_lock_time_for_max_multiplier >= 1, "Mul max time must be >= 1");
        require(_lock_time_min >= 1, "Mul min time must be >= 1");

        lock_time_for_max_multiplier = _lock_time_for_max_multiplier;
        lock_time_min = _lock_time_min;

        emit LockedStakeTimeForMaxMultiplier(lock_time_for_max_multiplier);
        emit LockedStakeMinTime(_lock_time_min);
    }

• veFXSYieldDistributor.sol
  function name: setYieldDuration
  event name:  YieldDurationUpdated
  variable:    yieldDuration->_yieldDuration

    function setYieldDuration(uint256 _yieldDuration) external onlyByOwnGov {
        require(periodFinish == 0 || block.timestamp > periodFinish, "Previous yield period must be complete before changing the duration for the new period");
        yieldDuration = _yieldDuration;
        emit YieldDurationUpdated(yieldDuration);
    }

• FraxCrossChainFarmSushi.sol
  function name: setMultipliers
  event name:  MaxVeFXSMultiplier  
          LockedStakeMaxMultiplierUpdated  
          veFXSPerFraxForMaxBoostUpdated  
  variable:    vefxs_max_multiplier->_vefxs_max_multiplier  
          lock_max_multiplier->_lock_max_multiplier  
          vefxs_per_frax_for_max_boost->_vefxs_per_frax_for_max_boost  

    function setMultipliers(uint256 _lock_max_multiplier, uint256 _vefxs_max_multiplier, uint256 _vefxs_per_frax_for_max_boost) external onlyByOwnGov {
        require(_lock_max_multiplier >= MULTIPLIER_PRECISION, "Mult must be >= MULTIPLIER_PRECISION");
        require(_vefxs_max_multiplier >= 0, "veFXS mul must be >= 0");
        require(_vefxs_per_frax_for_max_boost > 0, "veFXS pct max must be >= 0");

        lock_max_multiplier = _lock_max_multiplier;
        vefxs_max_multiplier = _vefxs_max_multiplier;
        vefxs_per_frax_for_max_boost = _vefxs_per_frax_for_max_boost;

        emit MaxVeFXSMultiplier(vefxs_max_multiplier);
        emit LockedStakeMaxMultiplierUpdated(lock_max_multiplier);
        emit veFXSPerFraxForMaxBoostUpdated(vefxs_per_frax_for_max_boost);
    }

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

    function setLockedStakeTimeForMinAndMaxMultiplier(uint256 _lock_time_for_max_multiplier, uint256 _lock_time_min) external onlyByOwnGov {
        require(_lock_time_for_max_multiplier >= 1, "Mul max time must be >= 1");
        require(_lock_time_min >= 1, "Mul min time must be >= 1");

        lock_time_for_max_multiplier = _lock_time_for_max_multiplier;
        lock_time_min = _lock_time_min;

        emit LockedStakeTimeForMaxMultiplier(lock_time_for_max_multiplier);
        emit LockedStakeMinTime(_lock_time_min);
    }

• StakingRewards.sol
  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

    function setRewardsDuration(uint256 _rewardsDuration) external onlyByOwnGov {
        require(
            periodFinish == 0 || block.timestamp > periodFinish,
            "Reward period incomplete"
        );
        rewardsDuration = _rewardsDuration;
        emit RewardsDurationUpdated(rewardsDuration);
    }

  function name: setMultipliers
  event name:  MaxCRBoostMultiplier
          LockedStakeMaxMultiplierUpdated
  variable:    cr_boost_max_multiplier->_cr_boost_max_multiplier
          locked_stake_max_multiplier->_locked_stake_max_multiplier

    function setMultipliers(uint256 _locked_stake_max_multiplier, uint256 _cr_boost_max_multiplier) external onlyByOwnGov {
        require(_locked_stake_max_multiplier >= 1, "Multiplier must be greater than or equal to 1");
        require(_cr_boost_max_multiplier >= 1, "Max CR Boost must be greater than or equal to 1");

        locked_stake_max_multiplier = _locked_stake_max_multiplier;
        cr_boost_max_multiplier = _cr_boost_max_multiplier;
        
        emit MaxCRBoostMultiplier(cr_boost_max_multiplier);
        emit LockedStakeMaxMultiplierUpdated(locked_stake_max_multiplier);
    }

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    locked_stake_time_for_max_multiplier->_locked_stake_time_for_max_multiplier

• StakingRewardsDualV2.sol
  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

  function name: setMultipliers
  event name:  MaxCRBoostMultiplier
          LockedStakeMaxMultiplierUpdated
  variable:    cr_boost_max_multiplier->_cr_boost_max_multiplier
          locked_stake_max_multiplier->_locked_stake_max_multiplier

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    locked_stake_time_for_max_multiplier->_locked_stake_time_for_max_multiplier

• veFXSYieldDistributorV3.sol
  function name: setYieldDuration
  event name:  YieldDurationUpdated
  variable:    yieldDuration->_yieldDuration

• FraxUniV3Farm_Volatile.sol
  function name: setMultipliers
  event name:  MaxVeFXSMultiplier
          LockedNFTMaxMultiplierUpdated
          veFXSPctForMaxBoostUpdated
  variable:    vefxs_max_multiplier->_vefxs_max_multiplier
          lock_max_multiplier->_lock_max_multiplier
          vefxs_per_frax_for_max_boost->_vefxs_per_frax_for_max_boost

  function name: setLockedNFTTimeForMinAndMaxMultiplier
  event name:  LockedNFTTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

• veFXSYieldDistributorV2.sol
  function name: setYieldDuration
  event name:  YieldDurationUpdated
  variable:    yieldDuration->_yieldDuration

• StakingRewardsDualV4.sol
  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

  function name: setMultipliers
  event name:  MaxVeFXSMultiplier
          LockedStakeMaxMultiplierUpdated
          veFXSPerFraxForMaxBoostUpdated
  variable:    vefxs_max_multiplier->_vefxs_max_multiplier
          lock_max_multiplier->_lock_max_multiplier
          vefxs_per_frax_for_max_boost->_vefxs_per_frax_for_max_boost

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

• StakingRewardsDual.sol
  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

  function name: setMultipliers
  event name:  MaxCRBoostMultiplier
          LockedStakeMaxMultiplierUpdated
  variable:    cr_boost_max_multiplier->_cr_boost_max_multiplier
          locked_stake_max_multiplier->_locked_stake_max_multiplier

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    locked_stake_time_for_max_multiplier->_locked_stake_time_for_max_multiplier

• StakingRewardsDualV3.sol
  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

  function name: setMultipliers
  event name:  MaxVeFXSMultiplier
          LockedStakeMaxMultiplierUpdated
          veFXSPerFraxForMaxBoostUpdated
  variable:    vefxs_max_multiplier->_vefxs_max_multiplier
          lock_max_multiplier->_lock_max_multiplier
          vefxs_per_frax_for_max_boost->_vefxs_per_frax_for_max_boost

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

• FraxFarmBSC_Dual_V5.sol
  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

  function name: setMultipliers
  event name:  LockedStakeMaxMultiplierUpdated
  variable:    lock_max_multiplier->_lock_max_multiplier

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

• MigratableFarmBSC.sol
  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

  function name: setMultipliers
  event name:  LockedStakeMaxMultiplierUpdated
  variable:    locked_stake_max_multiplier->_locked_stake_max_multiplier

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    locked_stake_time_for_max_multiplier->_locked_stake_time_for_max_multiplier

• AnyswapV4ERC20.sol
  function name: changeVault
  event name:  LogChangeVault
  variable:    pendingVault->newVault

  function name: changeMPCOwner
  event name:  LogChangeMPCOwner
  variable:    pendingVault->newVault

• FraxCrossChainFarm.sol
  function name: setMultipliers
  event name:  MaxVeFXSMultiplier
          LockedStakeMaxMultiplierUpdated
          veFXSPerFraxForMaxBoostUpdated
  variable:    vefxs_max_multiplier->_vefxs_max_multiplier
          lock_max_multiplier->_lock_max_multiplier
          vefxs_per_frax_for_max_boost->_vefxs_per_frax_for_max_boost

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

• FraxCrossChainFarmV2.sol
  function name: setMultipliers
  event name:  MaxVeFXSMultiplier
          LockedStakeMaxMultiplierUpdated
          veFXSPerFraxForMaxBoostUpdated
  variable:    vefxs_max_multiplier->_vefxs_max_multiplier
          lock_max_multiplier->_lock_max_multiplier
          vefxs_per_frax_for_max_boost->_vefxs_per_frax_for_max_boost

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

• veFXSYieldDistributorV4.sol
  function name: setYieldDuration
  event name:  YieldDurationUpdated
  variable:    yieldDuration->_yieldDuration

• CommunalFarm.sol
  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

  function name: setMultipliers
  event name:  LockedStakeMaxMultiplierUpdated
  variable:    lock_max_multiplier->_lock_max_multiplier

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

• FraxUniV3Farm_Stable.sol
  function name: setMultipliers
  event name:  MaxVeFXSMultiplier
          LockedStakeMaxMultiplierUpdated
          veFXSPerFraxForMaxBoostUpdated
  variable:    vefxs_max_multiplier->_vefxs_max_multiplier
          lock_max_multiplier->_lock_max_multiplier
          vefxs_per_frax_for_max_boost->_vefxs_per_frax_for_max_boost

  function name: setLockedNFTTimeForMinAndMaxMultiplier
  event name:  LockedNFTTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

• StakingRewardsDualV5.sol
  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

  function name: setMultipliers
  event name:  MaxVeFXSMultiplier
          LockedStakeMaxMultiplierUpdated
          veFXSPerFraxForMaxBoostUpdated
  variable:    vefxs_max_multiplier->_vefxs_max_multiplier
          lock_max_multiplier->_lock_max_multiplier
          vefxs_per_frax_for_max_boost->_vefxs_per_frax_for_max_boost

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

• FRAX3CRV_Curve_FXS_Distributor.sol
  function name: setPaused
  event name:  PauseChanged
  variable:    paused->_paused

  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

• StakingRewardsMultiGauge.sol
  function name: setRewardsDuration
  event name:  RewardsDurationUpdated
  variable:    rewardsDuration->_rewardsDuration

  function name: setMultipliers
  event name:  MaxVeFXSMultiplier
          LockedStakeMaxMultiplierUpdated
          veFXSPerFraxForMaxBoostUpdated
  variable:    vefxs_max_multiplier->_vefxs_max_multiplier
          lock_max_multiplier->_lock_max_multiplier
          vefxs_per_frax_for_max_boost->_vefxs_per_frax_for_max_boost

  function name: setLockedStakeTimeForMinAndMaxMultiplier
  event name:  LockedStakeTimeForMaxMultiplier
  variable:    lock_time_for_max_multiplier->_lock_time_for_max_multiplier

• celrFRAX.sol
  function name: updateBridge
  event name:  BridgeUpdated
  variable:    bridge->_bridge

• AnyswapV5ERC20.sol
  function name: changeVault
  event name:  LogChangeVault
  variable:    pendingVault->newVault

  function name: changeMPCOwner
  event name:  LogChangeMPCOwner
  variable:    pendingVault->newVault

• celrFXS.sol
  function name: updateBridge
  event name:  BridgeUpdated
  variable:    bridge->_bridge

• AnyswapV4ERC20.sol
  function name: changeVault
  event name:  LogChangeVault
  variable:    pendingVault->newVault

  function name: changeMPCOwner
  event name:  LogChangeMPCOwner
  variable:    pendingVault->newVault

Do you find our results useful? Your reply and invaluable suggestions would be greatly appreciated, and are vital for improving our tool. Thanks a lot for your time!

Hi Guys

I've been recently going through your code and I found that you create a bunch of almost identical contracts. For example here: https://github.com/FraxFinance/frax-solidity/tree/master/contracts/Oracle/Variants

Actually the implementations of all the contracts in the directory above are exactly the same apart form contract name and corresponding file name.

Coming from non-blockchain background I'm wondering why did you decide to put every pair in a separate contract? Is it for easier deployment?

I found this issue in https://github.com/FraxFinance/dev-frax-bamm/issues/2. The problem may stem from this repo still relying on npm and not pnpm. I'll get a PR submitted for the change of build.

In StakingRewards.sol L242, the withdraw() function does not check how much a user's balance of LP tokens comes from the locked portion of stakes, and thus may allow a user to withdraw from their locked balance. When doing so, it subtracts the non-boosted amount from _boosted_balances instead of the boosted, locked amount, and thus allows for people to manipulate their balance in the StakingRewards contract.

This bug has been reported by @samczsun.

Link to bug:

line 379 - 398 in '/src/hardhat/contracts/Bridges/CrossChainBridgeBacker.sol'

    // Swap canToken for anyToken [GOVERNANCE CALLABLE]
    function swapCanonicalForAny(uint256 token_type, uint256 token_amount) external onlyByOwnGov {
        _swapCanonicalForAny(token_type, token_amount);
    }

    // Swap anyToken for canToken [INTERNAL]
    function _swapCanonicalForAny(uint256 token_type, uint256 token_amount) internal {
        if (token_type == 0) {
            // FRAX
            // Approve and swap
            canFRAX.approve(address(canFRAX), token_amount);
            canFRAX.exchangeCanonicalForOld(address(anyFRAX), token_amount);
        }
        else {
            // FXS
            // Approve and swap
            canFXS.approve(address(canFXS), token_amount);
            canFXS.exchangeCanonicalForOld(address(anyFXS), token_amount);
        }
    }

I think the commented code should be // swap canToken for anyToken [INTERNAL]. But more importantly, shouldn't it be anyFRAX.approve(address(canFRAX), token_amount); and anyFXS.approve(address(canFXS), token_amount);?