Skip to content

Latest commit

 

History

History
79 lines (50 loc) · 3.03 KB

114-certora-aave-engagement-2022-23.md

File metadata and controls

79 lines (50 loc) · 3.03 KB

Proposal 114. Certora <> Aave engagement for 2022/2023


Voting link

https://app.aave.com/governance/proposal/?proposalId=114


Governance forum discussion

https://governance.aave.com/t/security-and-agility-of-aave-smart-contracts-via-continuous-formal-verification/10181


BGD analysis


Proposal types

💸 funds-release

💳 funds-allowance


Context

This proposal bootstraps an engagement for services with Certora for 1 year, in the context of security assessment and formal verification. The payload initiates one payment stream of 1'890'000 aUSDC, and another of 9'957 AAVE.


Proposal creation

Transaction: https://etherscan.io/tx/0x7a8e6121dfd595c21bc154dbcb44c4032637bbebdfcdf6cf3653d610f3f19485

- id: 114
- creator: 0x070341aa5ed571f0fb2c4a5641409b1a46b4961b
- executor: 0xee56e2b3d491590b5b31738cc34d5232f378a8d5
- targets: [0x2d2b1bf70d98ae9a8cc9a3d7a49c2d321ecc6c04]
- values: [0]
- signatures: [execute()]
- calldatas: [0x]
- withDelegatecalls: [true]
- startBlock: 15933758
- endBlock: 15952958
- strategy: 0xb7e383ef9b1e9189fc0f71fb30af8aa14377429e
- ipfsHash: 0x8c5c6b73375a981af5e6b8b1cf860500f5c2cfc0570a98203b7f6b48c03d42ba

Aave Seatbelt report

https://github.com/bgd-labs/seatbelt-for-ghosts/blob/main/reports/Aave/0xEC568fffba86c094cf06b22134B23074DFE2252c/114.md


Technical analysis

We have verified the proposal payload does the following:

  1. By interacting with the AaveEcosystemReserveController, create a payment stream of aUSDC from the Aave v2 Ethereum Collector to the address defined as Certora beneficiary.
  2. Also by interacting with the AaveEcosystemReserveController, create a payment stream of AAVE from the AAVE Ecosystem Reserve to the address defined as Certora beneficiary.

The stream duration is 360 days long, considering 30-days months for totalling 1 year, which we consider acceptable.


BGD validations

✅ The code on the proposal payload corresponds to the proposal specification.

✅ The proposal includes a proper tests suite, checking all necessary post-conditions.

✅ BGD reviewed the payload before the proposal was submitted.

✅ Only one payload used via delegatecall

✅ BGD reviewed the procedure followed to submit the proposal.