Skip to content

Sentora-3 #377

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kingofclubstroyDev wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Sentora-3 #377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
96ec35c
Sentora-3
kingofclubstroyDev Sep 4, 2025
e882ca0
fixed date
kingofclubstroyDev Sep 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 48 additions & 0 deletions client/library/library/audits/sentora-3.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,48 @@
<page
clientName="Sentora"
reportDate="September 4, 2025"
auditTitle="Sentora A-3"
auditVersion="1.0.0"
layout="/library/audits/_layout.html"
customRepoInfo
customReviewInfo
>
<content-for name="schedule">
The security audit was performed by the Macro security team on August 29th - 30th 2025.
</content-for>

<content-for name="spec">
<ul>
<li>Discussions with the {{page.clientName}} team.</li>
</ul>

</content-for>

<h2 id="tmaar">Roles</h2>
<template type="audit-markdown">
<ul>
<li>Owner: Controller of main functions with the ability to set configurations, approve tokens for protocols, and can withdraw assets out. </li>
<li>Executor: Have the ability to move assets held into and out of protocols like Aave with the intent to earn yield and accumulate value for the owner. They are trusted to act in the best interest of the owner.</li>
</ul>
</template>

<content-for name="source-code">

<p>
<br>
Specifically, we audited the following contracts:
</p>

<template type="file-hashes">
9f10fb91dd1f73ed27a05b8667848e3142e9a97288a265a432603c1c0c54c27c contracts/0.8.21/AaveYieldPosition/BasePositionManager.sol
398201f99e9acd066ae31769337bca6747f105155d001aefefe646b6ec9197e1 contracts/0.8.21/AaveYieldPosition/single/PositionManager.sol
fade09db5cc83f4bd0b6e4e83b04f6b835bdd5e0ee57f1f780119275955cf297 contracts/0.8.21/AaveYieldPosition/single/PositionManagerV3.sol
800675d5b79d86519237572556faa267f8aedacb9f108f18adba6fc968072d70 contracts/0.8.21/AaveYieldPosition/single/PositionManagerV3Merkl.sol
d12550d25a4805f2d89bda548e4280027dd3e2e5eabd5153d7140ea28f8797a5 contracts/0.8.21/LoanManager/LoanManager.sol
ab5db0eb11c600b5b49d240b73f7f9aa6b7376cd7dc6d7a1294b40ab9d77f37f contracts/0.8.21/LoanManager/LoanManagerV3.sol
4a3ea284ef80883066625d2758b6f3db3207156a141592c0c4d5707338330bf9 contracts/0.8.21/SupervisedLoan/SupervisedLoanPositionManager.sol
823a2b5e8de0c11d4647fb046b865c8eae9142b28a0aaa0f4677b7e043d7b7d9 contracts/0.8.21/SupervisedLoan/SupervisedLoanPositionManagerSwapBorrow.sol

</template>
</content-for>
</page>
12 changes: 12 additions & 0 deletions content/collections/public/sentora-3-issues.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
<item>
<field name="topic">Informational</field>
<field name="content">
## [I-1] Clear approvals before changing assemble or borrow token
`SupervisedLoanPositionManagerSwapBorrow` allows for arbitrary swaps with a router, intended to be via 1Inch, limited to swapping the set assemble token with the borrow token, or vice versa. Balance before and after the swap are checked and validated with expected values, however if there are prior approvals and balance of a assemble token changed via `updateAssembleToken()`, could result in executors using malicious swap data to drain these tokens.

**Remediations to Consider**

Always removal approvals from the router if changing up assemble token, or any config token as a precaution.
</field>
</item>