Endaoment A-2

Currently Aave’s referral program is inactive for both V2 and V3 contracts, but could be re-implemented pending a governance vote. Currently in AaveUSDCPortfolio and AaveV3USDCPortfolio the referalCode used is set to 0, which indicates no referral, but in the case where the program starts back up, there may be a benefit to setup a referalCode for Endaoment and use on deposits.

Remediations to Consider

Add a permissioned function that allows setting the referalCode in case Endaoment would benefit from referring entities to use Aave.

In each of the yield bearing portfolio contracts, in their constructor there are two checks to ensure that the baseToken is equal to the set asset and the asset returned by _getAsset.

// The `asset` should match the base token, which means we expect it to be USDC. So we
// execute some checks to make sure inputs are consistent.
if (address(baseToken) != _getAsset(_receiptAsset)) revert AssetMismatch();
if (address(baseToken) != asset) revert AssetMismatch();

Reference: CompoundV3USDCPortfolio.sol#L52-L55

However, both are equivalent checks, as the value of asset is set in the constructor of Portfolio.sol using the _getAsset() function.

asset = _getAsset(_receiptAsset);

Reference: Portfolio.sol#L120

Remediations to Consider

In each of the yield bearing portfolio contracts, remove one of these checks, as they are duplicates.

Since there is a constraint for each of the yield bearing portfolio contracts that the asset equals the baseToken in their constructors, any call to transfer the asset tokens can directly be called on baseToken instead of casting asset to an ERC20.

Remediations to Consider

Replace casting asset to an ERC20 and use baseToken instead.

Endaoment is deployed on both Ethereum and Base, however the yield bearing portfolios use constant address values for the protocols they interact with that are deployed on Ethereum. In the case where a portfolio would want to be deployed on another chain, like Base, it would require a duplicate contract to be added to the repo with a differing protocol address, if the address of the protocol varies from the Ethereum version. If these addresses were immutable and initialized in the constructor, then these portfolio contracts could be deployed on any desired chain that the portfolio’s protocol supports.

Remediations to Consider

Replace constant protocol addresses with immutable values and initialize the values in their constructors.

In the following instances, the NatSpec documentation is incomplete:

1. In YearnUSDCPortfolio, convertToUsdc() and convertToYvUsdc() are missing @param and @return fields
2. In CompoundUSDCPortfolio, compoundExchangeRateCurrent() is missing the @return field

Whenever a entity either deposits or redeems, it invokes multiple ERC20 transfers to the treasury due to AUM fees as well as deposit/redemption fees. Each of these costs the entity extra gas to execute, and could be reduced.

Remediations to Consider

Portfolio could be reworked to transfer the sum of the AUM fees and the deposit/redeem fees to reduce the number of external transfer calls. Alternatively instead of transferring fees immediately, keep track of fees owed and allow a permissioned function to take the owed fees and reset the tracked value, while making sure to subtract the fees owed from any calculations relating to the total supply of funds in the portfolio, while ensuring rebasing tokens are handled appropriately. Doing either would reduce the gas cost for users interacting with the protocol.

In Portfolio.sol, the function _maxCap() checks the registry to ensure the asset is the same as the registry’s baseToken.

function _checkCap() internal virtual {
    if (asset != address(registry.baseToken())) revert BadCheckCapImplementation();
    if (totalAssets() > cap) revert ExceedsCap();
}

Reference: Portfolio.sol#L295-L298

However, in each of the 5 portfolio contracts in scope, it is ensured in the constructor that the asset is the same as the registry’s baseToken, since both of which are immutable, the check is unnecessary.

if (address(baseToken) != asset) revert AssetMismatch();

Reference: AaveUSDCPortfolio.sol#L56

Remediations to Consider

In each of the portfolio contracts in scope, override the _checkCap() function, removing the unnecessary check, reducing gas costs.

In Portfolio.sol, the _checkCap() function queries the registry for the baseToken and checks to see if the portfolios asset is the same.

function _checkCap() internal virtual {
    if (asset != address(registry.baseToken())) revert BadCheckCapImplementation();
    if (totalAssets() > cap) revert ExceedsCap();
}

Reference: Portfolio.sol#L295-L298

However, the baseToken value in the registry is immutable, so it cannot change, and in Portfolio.sol’s constructor it sets the value of baseToken by querying it from the registry, so the value of baseToken will be the same as the value queried from the registry, but costs less gas to use as it isn’t an external call.

Remediations to Consider

Use baseToken instead of registry.baseToken() in _checkCap() to prevent an external call, and reduce gas cost.