Convex Finance 백서 전문

%2FTdXr1RZ6lZ4QtVOjphd8%2Fpeck.png?alt=media&token=bc787bea-6fb4-4c34-baf1-439e17ddc16e">peck.png</a></td><td>null</td></tr><tr><td>Convex Wrapper Audit by Chainsecurity</td><td></td><td align="right">April 2023</td><td>Bi de bu</td><td><a href="https://github.com/convex-eth/platform/blob/main/audit/Smart-Contract-Audit-Silo_Finance_Curve__Convex_Feature-ChainSecurity.pdf">https://github.com/convex-eth/platform/blob/main/audit/Smart-Contract-Audit-Silo_Finance_Curve__Convex_Feature-ChainSecurity.pdf</a></td><td><a href="https://2181409797-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXUXhi90m2Jg6S04DpE%2Fuploads%2FGt4Rq8yrLuKLReuLc2yl%2Fchainsec.png?alt=media&token=fe83ad3e-f896-4db4-ab47-da3bb68d3241">chainsec.png</a></td><td>null</td></tr><tr><td>Convex Wrapper Audit by Nomoi</td><td></td><td align="right">Jan 2023</td><td></td><td><a href="https://github.com/convex-eth/platform/blob/main/audit/convex-cvxcrv-staking-wrapper.pdf">https://github.com/convex-eth/platform/blob/main/audit/convex-cvxcrv-staking-wrapper.pdf</a></td><td><a href="https://2181409797-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXUXhi90m2Jg6S04DpE%2Fuploads%2FCyC0TY9rLi3Xry1LeMNM%2Fnomoi.png?alt=media&token=aef7c716-b349-423b-ae87-7e6e0367a10e">nomoi.png</a></td><td>null</td></tr><tr><td>Convex Frax audit by Peckshield </td><td></td><td align="right">April 2022</td><td></td><td><a href="https://github.com/convex-eth/frax-cvx-platform/blob/main/audits/PeckShield-Audit-Report-Convex-Frax-Staking-v1.0.pdf">https://github.com/convex-eth/frax-cvx-platform/blob/main/audits/PeckShield-Audit-Report-Convex-Frax-Staking-v1.0.pdf</a></td><td><a href="https://2181409797-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXUXhi90m2Jg6S04DpE%2Fuploads%2FTdXr1RZ6lZ4QtVOjphd8%2Fpeck.png?alt=media&token=bc787bea-6fb4-4c34-baf1-439e17ddc16e">peck.png</a></td><td>null</td></tr><tr><td>Convex Sidechain Audit by Peckshield</td><td></td><td align="right">Nov 2022</td><td></td><td><a href="https://github.com/convex-eth/sidechain-platform/blob/main/audits/PeckShield-Audit-Report-Convex-Sidechain-v1.0.pdf">https://github.com/convex-eth/sidechain-platform/blob/main/audits/PeckShield-Audit-Report-Convex-Sidechain-v1.0.pdf</a></td><td><a href="https://2181409797-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXUXhi90m2Jg6S04DpE%2Fuploads%2FTdXr1RZ6lZ4QtVOjphd8%2Fpeck.png?alt=media&token=bc787bea-6fb4-4c34-baf1-439e17ddc16e">peck.png</a></td><td>null</td></tr><tr><td>Convex Sidechain Audit by Nomoi</td><td></td><td align="right">Jan 2023</td><td></td><td><a href="https://github.com/convex-eth/sidechain-platform/blob/main/audits/convex-sidechain-audit-nomoi.pdf">https://github.com/convex-eth/sidechain-platform/blob/main/audits/convex-sidechain-audit-nomoi.pdf</a></td><td><a href="https://2181409797-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MXUXhi90m2Jg6S04DpE%2Fuploads%2FCyC0TY9rLi3Xry1LeMNM%2Fnomoi.png?alt=media&token=aef7c716-b349-423b-ae87-7e6e0367a10e">nomoi.png</a></td><td>null</td></tr></tbody></table> # Convex Treasury The[ Convex Treasury](https://etherscan.io/address/0x1389388d01708118b497f59521f6943Be2541bb7) is given 9.7% of the total **CVX** supply, vested over one year. It is controlled by the Convex [Multisig](https://app.safe.global/transactions/queue?safe=eth%3A0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB). ### How will the treasury will be used? **CVX** will be used for awarding or incentivizing actions/tokens/people/platforms that are deemed to have a positive influence on the well being of the Convex Finance platform. ### Who will decide how the treasury will be used? Currently the use of treasury funds will be at the discretion of the Convex Team. #### # Multisig Admin Rights ### Multisig Address * Ethereum: [GnosisSafe](https://app.safe.global/home?safe=eth:0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB) * Arbitrum: [GnosisSafe](https://app.safe.global/arb1:0x6111ABF720051309012FcdBc2910054E41dcFF8c) ### Multisig Members (3 of 5) * C2tP - Convex Finance * Winthorpe - Convex Finance * Benny - Llama Airforce * Tommy - Votium * Sam - Frax Finance ### Convex Finance [multisig](https://gnosis-safe.io/app/#/safes/0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB) can perform the following functions * Update the [stash factory](https://etherscan.io/address/0x877288c4e6eba4f635ba7428706447353b47de75). * This is to make sure we can handle new gauge types on the Curve platform. Stashes control extra rewards (SNX, BOR, PNT, LDO, etc) by claiming them from the curve gauge and transferring them to Convex reward contracts. * Update the [pool manager](https://etherscan.io/address/0x3b2D30734491AD77880d31e8aFe2A4d8aC135a9C). * This is to make sure we can handle new types of pools on the Curve platform and/or add rules to adding new pools if needed. * Control the [arbitrator vault](https://etherscan.io/address/0x25E12482a25CF36EC70fDA2A09C1ED077Fc21616). * Before Curve v3 gauges, if two gauges have the same extra reward (currently stkAave) it is impossible to tell exactly how much each pool is entitled to. Thus if two pools share the same reward, these rewards are pushed to an arbitrator vault to later use off chain logs and redistribute to the appropriate pools. * Change platform fees allocated to stakers within hard-coded ranges. * 10-15% for [**cvxCRV** ](/convexfinance/general-information/why-convex/understanding-cvxcrv)stakers rewards * 3-6% for [**CVX** ](/convexfinance/general-information/understanding-cvx)staker rewards * 0-2% for "treasury" fees. (This is an arbitrary address that can be used for various functions, thus the low limit of 2%) * 0.1 - 1.0% for "caller" fees. Gas reimbursement for calling gas heavy functions to harvest and distribute rewards. * There is an absolute fee ceiling of 20% * Set the "treasury address" and allocate up to 2% of platform fees back to this address. * Controls the [Convex Treasury](https://etherscan.io/address/0x1389388d01708118b497f59521f6943Be2541bb7) Account. ([info](/convexfinance/faq/convex-treasury)) * Vote for Curve DAO proposals. * Vote for Curve gauge weights. * Set distribution weights on the [Convex Master Chef](https://etherscan.io/address/0x5F465e9fcfFc217c5849906216581a657cd60605). * Shutdown/pause new deposits to Curve Pool staking contracts. * ***Allows users to withdraw all funds*** * Shutdown/pause new deposits to everything . * ***Allows users to withdraw all funds*** * Apply a new "operator" on the [whitelisted proxy contract](https://etherscan.io/address/0x989AEb4d175e16225E39E87d0D97A3360524AD80) if and ONLY if the current operator is completely shutdown. * After removing all liquidity from convex, the system can be shutdown and rebooted as a new version. * **vlCVX**: add a new reward * **vlCVX**: change distributor of each reward type * **vlCVX**: set Staking ratio of locked **CVX** * **vlCVX**: set boost parameters for **vlCVX** * **vlCVX**: set the kick incentive for **vlCVX** * **vlCVX**: recover non-reward erc20 tokens * **vlCVX**: shutdown **vlCVX** contract. (allows everyone to withdraw immediately) {% hint style="info" %} Admin controls do not have access to user funds or other dangerous calls and thus time-lock delays are not required. {% endhint %} {% hint style="success" %} Convex Finance multisig **does NOT** have direct access to user deposits. If there is anything that invalidates this statement, please disclose. {% endhint %} # Airdrops From Other Platforms Convex receives airdrops from various platforms in different ways depending on the airdrop criteria: ## **Voting Rewards** Rewards for voting on a specific proposal are distributed to vlCVX holders who actively voted on that proposal. Only vlCVX users who participated in the vote are eligible. ## **Platform Airdrops** Airdrops directed "to Convex" as a platform are distributed to vlCVX holders, weighted by their vlCVX balance at the time of the airdrop snapshot. ## **veCRV Holder Airdrops** Airdrops sent "to veCRV" holders (not based on voting participation) are distributed to cvxCRV holders, as they represent the veCRV position within the Convex ecosystem. # Bug Bounties Scope: Issues which can lead to substantial loss of money, critical bugs like a broken live-ness condition or irreversible loss of funds. Disclosure policy: * Let us know as soon as possible upon discovery of a potential security issue. * Provide us a reasonable amount of time to resolve the issue before any disclosure **to the public or a third-party.** Exclusions: * Already known vulnerabilities. * Vulnerabilities in front-end code not leading to smart contract vulnerabilities. Eligibility: * You must be the first reporter of the vulnerability * You must be able to verify a signature from same address * Provide enough information about the vulnerability Bounty payout: | Likelihood | Low Severity | Medium Severity | High Severity | | -------------- | ------------ | --------------- | ------------- | | Almost Certain | $10,000.00 | $50,000.00 | $250,000.00 | | Possible | $1,000.00 | $10,000.00 | $50,000.00 | | Unlikely | $1,000.00 | $1,000.00 | $10,000.00 | Contact:<contact@convexfinance.com> # Known Issues ### Multisig Weakness and Mitigation <a href="#mitigation" id="mitigation"></a> Convex has strived to be a trustless platform in which deposits can never be touched or accessed by the admin account. Since launch we have determined a few vectors that would go against that stance and thus have implemented various checks and conditions that the admin account must clear before certain actions can be taken. With the help from V (OpenZeppelin) and 0xJuicer/0xPhaedra0x (Tang Finance) we have implemented layers that either completely block some patterns or make it extremely difficult to put into action. Additional Layers: \ poolManagerProxy: [0x5F47010F230cE1568BeA53a06eBAF528D05c5c1B](https://etherscan.io/address/0x5f47010f230ce1568bea53a06ebaf528d05c5c1b)\ poolManagerSecondaryProxy: [0xD20904e5916113D11414F083229e9C8C6F91D1e1](https://etherscan.io/address/0xD20904e5916113D11414F083229e9C8C6F91D1e1)\ boosterOwner: [0x3cE6408F923326f81A7D7929952947748180f1E6](https://etherscan.io/address/0x3cE6408F923326f81A7D7929952947748180f1E6) These layers, to our knowledge, successfully block most vectors that could be used. However there is still one known path that uses a series of fake gauges to create fake pools and exploits the shutdown system. We believe this has been sufficiently mitigated as the steps that must be taken are as follows: * Create a fake gauge for an existing pool and create an Curve DAO proposal to add said fake gauge * Pass Curve DAO proposal undetected (7 day voting period) * Give the fake gauge weight on Curve's gauge controller. * Shutdown an existing legit Convex pool. (Curve LP tokens are unstaked and returned to Booster contract) * Add a new pool on Convex that uses the fake gauge but legitimate LP tokens * Loop fake liquidity onto the gauge to increase Convex Deposit Tokens (deposit, withdraw directly from gauge, deposit again) * Call shutdownSystem() on Pool Manager Secondary Proxy. New pools can no longer be added * Call queueForceShutdown() on Booster Owner. A normal shutdown call will fail with the fake pool as there are more Convex Deposit Tokens than there are LP tokens, thus need to use this timelock shutdown feature. * Wait 30 days for the timelock to complete * Call forceShutdownSystem() on Booster Owner * Withdraw real Curve LP tokens using the illegitimate Convex Deposit Tokens We believe this process which requires a DAO proposal, shutting down a legitimate pool, and waiting for a 30 day timelock should be sufficient mitigation. We are writing this process here as well so that this weakness is known and can be detected.