Summary
Gearbox Protocol implements the third version of the core Gearbox protocol, a protocol that allows users to open leveraged positions on various protocols.
The codebase has undergone a relatively large number of review iterations. These iterations included 3 brainstorming sessions with the Gearbox team where different attack vector scenarios were discussed. While our rigorous iterative process reflects our commitment to enhancing the security of the protocol, it also highlights its complexity and the need for continuous vigilance. Our client’s codebase is fundamentally secure, yet our thorough approach underlines the evolving nature of security threats and our proactive stance in anticipating and mitigating potential risks.
The most critical subjects covered in our audit are the correctness of the accounting of the debt, the interest and the fees, the voting, the configuration of the system, the implementation of the quotas, the liquidation mechanism, and the opportunities to execute arbitrary code. The most important issue Too Many Bots Can Block Liquidation, uncovered in the first iteration of the review, could temporarily prevent the liquidation of a credit account. The issue has been fixed. During the fixes review a critical issue Anyone Can Redistribute The Votes was uncovered which completely breaks the voting mechanism used by the system. The issues have been addressed. The most recent iterations only revealed up to medium severity issues. Hence, we find the security regarding the aforementioned subjects to be high. It is important to note that the project is significantly exposed to errors or misunderstandings in the functionality of integrated third-party systems. Reviewing these external systems for correctness was out of the scope of this audit.
The general subjects covered are access control, documentation and specification, gas efficiency, and the complexity of the implementation. Security regarding all the aforementioned subjects is high, however, we need to emphasize that the code complexity is high. Moreover, the contracts in this scope have undergone many changes during the review. This in combination with the fact that the reviews are limited in time reduces our confidence in the assessment of the system's security level.
In summary, we find that the codebase could provide a high level of security should all the issues be fixed and no more issues be uncovered during the review of their fixes. It is important to note that security audits are time-boxed and cannot uncover all vulnerabilities. They complement but don't replace other vital measures to secure a project.
About Gearbox V3 Core
Gearbox Protocol implements the third version of the core Gearbox protocol, a protocol that allows users to open leveraged positions on various protocols.
“Gearbox is a generalized leverage protocol: it allows anyone to take leverage in a DeFi-native way and then use it across various DeFi protocols. You take leverage with Gearbox and then use it on other protocols you already love. For example, you can leverage trade on Uniswap, leverage farm on Yearn or Curve and Convex, make complex delta-neutral strategies involving options and derivatives, get Leverage-as-a-Service for your structured product doing complex positions, etc.
The protocol has two sides to it: passive liquidity providers who earn higher APY by providing liquidity; – and active traders, farmers, or even other protocols who can borrow those assets to trade or farm with x4+ leverage.”