Basin

AMM + Oracle|1,200 LOC|1H + 12M = 13 findings|Repo

Tool Results

Official Findings (13)

H-01Pumps are not updated in shift() and sync(), allowing oracle manipulation

M-01Well.sol: Incorrect slippage protection in _addLiquidity

M-02Incorrect EMA calculation in MultiFlowPump

M-03Well.sol: Tokens received amount not checked

M-04No fees enables sandwich DoS

M-05Incorrect casting of reserve values in readLastInstantaneousReserves

M-06MultiFlowPump uses different block.timestamp granularity

M-07Reserve data can be manipulated in Wells with more than 2 tokens

M-08LibLastReserveBytes.readBytes packs reserves incorrectly

M-09Incorrect proportional LP calculation for 2+ tokens

M-10ConstantProduct2 is susceptible to overflow

M-11Well can be rendered unusable by donation of a small amount

M-12Incorrect init of cumulative reserves in MultiFlowPump