105 lines
4.2 KiB
Markdown
105 lines
4.2 KiB
Markdown
# Fixes Applied
|
|
|
|
## Critical Fixes
|
|
|
|
### 1. ✅ AtomicExecutor Flash Loan Callback Security
|
|
**File**: `contracts/AtomicExecutor.sol`
|
|
- **Fixed**: Added `allowedPools` mapping to track authorized Aave Pool addresses
|
|
- **Fixed**: Changed callback authorization from `msg.sender == address(this)` to `allowedPools[msg.sender]`
|
|
- **Added**: `setAllowedPool()` function for owner to allow/deny pool addresses
|
|
- **Impact**: Prevents unauthorized flash loan callbacks
|
|
|
|
### 2. ✅ Price Oracle Weighted Average Bug
|
|
**File**: `src/pricing/index.ts`
|
|
- **Fixed**: Corrected weighted average calculation using proper fixed-point arithmetic
|
|
- **Changed**: Uses 1e18 precision for weight calculations
|
|
- **Fixed**: Division logic now correctly computes weighted average
|
|
- **Impact**: Price calculations are now mathematically correct
|
|
|
|
### 3. ✅ Compiler Missing Action Types
|
|
**File**: `src/planner/compiler.ts`
|
|
- **Added**: `compoundV3.withdraw` implementation
|
|
- **Added**: `compoundV3.borrow` implementation
|
|
- **Added**: `compoundV3.repay` implementation
|
|
- **Added**: `maker.openVault` implementation
|
|
- **Added**: `maker.frob` implementation
|
|
- **Added**: `balancer.swap` implementation
|
|
- **Added**: `curve.exchange` implementation
|
|
- **Added**: `lido.wrap` implementation
|
|
- **Added**: `lido.unwrap` implementation
|
|
- **Impact**: Most strategy actions can now be compiled and executed
|
|
|
|
### 4. ✅ Flash Loan Integration
|
|
**File**: `src/planner/compiler.ts`
|
|
- **Fixed**: Flash loan compilation now properly wraps callback operations
|
|
- **Added**: Steps after flash loan are compiled as callback operations
|
|
- **Fixed**: Flash loan execution calls executor's `executeFlashLoan()` function
|
|
- **Impact**: Flash loan strategies can now be properly executed
|
|
|
|
### 5. ✅ Uniswap Recipient Address
|
|
**File**: `src/planner/compiler.ts`
|
|
- **Fixed**: Changed hardcoded zero address to use `executorAddress` parameter
|
|
- **Added**: `executorAddress` parameter to `compile()` and `compileStep()` methods
|
|
- **Updated**: Engine passes executor address to compiler
|
|
- **Impact**: Swaps now send tokens to executor instead of zero address
|
|
|
|
### 6. ✅ MakerDAO CDP ID Parsing
|
|
**File**: `src/adapters/maker.ts`
|
|
- **Fixed**: Implemented CDP ID parsing from `NewCdp` event in transaction receipt
|
|
- **Removed**: Placeholder return value
|
|
- **Added**: Event parsing logic to extract CDP ID
|
|
- **Impact**: `openVault()` now returns actual CDP ID
|
|
|
|
### 7. ✅ Deploy Script Updates
|
|
**File**: `scripts/Deploy.s.sol`
|
|
- **Added**: Call to `setAllowedPool()` to allow Aave Pool for flash loan callbacks
|
|
- **Added**: Balancer Vault to allowed targets
|
|
- **Impact**: Deployed executor will be properly configured for flash loans
|
|
|
|
## Remaining Issues
|
|
|
|
### High Priority (Still Need Fixing)
|
|
1. **Chain Registry Placeholder Addresses** - Many addresses are still placeholders
|
|
- Aave PoolDataProvider: `0x7B4C56Bf2616e8E2b5b2E5C5C5C5C5C5C5C5C5C5` (mainnet)
|
|
- Maker addresses: `0x19c0976f590D67707E62397C1B5Df5C4b3B3b3b3`, `0x9759A6Ac90977b93B585a2242A5C5C5C5C5C5C5C5`
|
|
- USDT Chainlink: `0x3E7d1eAB1ad2CE9715bccD9772aF5C5C5C5C5C5C5`
|
|
- Base PoolDataProvider: `0x2d09890EF08c270b34F8A3D3C5C5C5C5C5C5C5C5`
|
|
- Missing L2 protocol addresses
|
|
|
|
2. **Aggregator API Integration** - Still returns placeholder quotes
|
|
- Need to integrate 1inch API for real quotes
|
|
- Need to encode swap data properly
|
|
|
|
3. **Cross-Chain Orchestrator** - Still placeholder
|
|
- No CCIP/LayerZero/Wormhole integration
|
|
|
|
4. **Gas Estimation** - Still crude approximation
|
|
- Should use `eth_estimateGas` for accurate estimates
|
|
|
|
5. **Fork Simulation** - Basic implementation
|
|
- Needs proper state snapshot/restore
|
|
- Needs calldata tracing
|
|
|
|
### Medium Priority
|
|
- Permit2 integration in compiler
|
|
- Flashbots integration in execution engine
|
|
- Token decimals fetching in price oracle
|
|
- More comprehensive error handling
|
|
- Unit and integration tests
|
|
|
|
### Low Priority
|
|
- KMS/HSM integration
|
|
- Template system
|
|
- Documentation improvements
|
|
|
|
## Summary
|
|
|
|
**Fixed**: 7 critical issues
|
|
**Remaining**: ~15 high/medium priority issues, ~10 low priority issues
|
|
|
|
The codebase is now significantly more functional, with critical security and functionality issues resolved. The remaining issues are mostly related to:
|
|
- Configuration (addresses need to be verified/updated)
|
|
- External integrations (APIs, cross-chain)
|
|
- Testing and polish
|
|
|