Summary
Limited reviews are best-effort checks, and do not provide assurances comparable to a non-limited codeassessment. Note that only the differences between Gravita and Trinity were in scope, assuming Gravitais bug-free.
The most critical subjects covered are correct accounting, correctness of the liquidation and redemptionmechanisms, and correctness of the fees and their distribution. Accounting correctness was improved, asthe issue Vessel Fees Are Not Added to Global Debt was fixed. Correctness of the redemption andliquidation mechanism was low, see Redemptions Are Not Possible in Recovery Mode and LiquidationsAre Not Disabled. In response to this, there was a major specification change during the review period.Correctness of the fees is improvable, see Borrowing fees are not applied before closing a vessel andBorrowing fees need to be triggered every epoch.
The general subjects covered are testing and documentation. Testing could be improved, as manyfunctional issues were uncovered that could have been found through rigorous testing. Documentationcould be improved, as some changes made are not yet documented in detail.
As the goal of this limited review was to provide time-bound security insights on a complex codebase in alimited time, and as a large number of issues were uncovered, we refrain from assigning a specificoverall level of security to the codebase.
It is important to note that security reviews are time-boxed and cannot uncover all vulnerabilities. Theycomplement but don't replace other vital measures to secure a project.
About Trinity
Trinity is a protocol designed to facilitate borrowing against yield-bearing collateral. Borrowers mint TRI, adollar-based token that can be used to take leveraged T-Bill positions and capture Trinity protocol feesthrough staked TRI (sTRI).