Basin Smart Contracts

About Grove Basin

GroveLabs implements Basin, a liquidity pool that facilitates atomic swaps between a tokenized credit asset, its underlying collateral, and a stablecoin.

Audit Summary

The most critical subjects covered in our audit are asset solvency, functional correctness, access control, precision of arithmetic operations and front-running. The general subjects covered are specification, gas efficiency and trustworthiness.

In summary, we find that the codebase provides a good level of security. The significant findings reported in Version 1 were addressed in Version 2 , which itself raised one additional medium severity correctness issue and one informational finding. The medium severity issue was addressed in Version 3 ; the informational finding was acknowledged.

Version 7 extends GroveBasinFactory with a full-setup deployment flow that deploys and configures a Basin, its pocket, redeemer, and optionally an admin timelock in a single transaction; it raised one low severity correctness finding in the new deployment flow. The latest reviewed version, Version 8, adds GroveBasinUnpauser, a pass-through contract that lets dedicated unpauser roles clear pause flags on a Basin without holding the full MANAGER_ADMIN_ROLE, and hardens the full-setup deployment flow of GroveBasinFactory by rejecting unsafe deployment configurations, separating the caller-selected and sequential CREATE2 salt ranges, and correcting the fee bound initialization.

It is important to note that security audits are time-boxed and cannot uncover all vulnerabilities. They complement but don’t replace other vital measures to secure a project.