Basin Smart Contracts
ChainSecurity has been a close partner to Grove as we ship products and infrastructure used by some of the largest financial institutions and onchain protocols. We can consistently rely on them to enforce and improve upon the strict security standards that Grove and our partners demand.
About Basin Smart Contracts
GroveLabs implements Basin, a liquidity pool that facilitates atomic swaps between a tokenized credit asset, its underlying collateral, and a stablecoin.
Audit Summary
The most critical subjects covered in our audit are asset solvency, functional correctness, access control, precision of arithmetic operations and front-running. The general subjects covered are specification, gas efficiency and trustworthiness.
In summary, we find that the codebase provides a good level of security. The significant findings reported in Version 1 were addressed in Version 2, which itself raised one additional medium severity correctness issue and one informational finding. The medium severity issue was addressed in Version 3; the informational finding was acknowledged. Version 7 extends GroveBasinFactory with a full-setup deployment flow that deploys and configures a Basin, its pocket, redeemer, and optionally an admin timelock in a single transaction; it raised one low severity correctness finding in the new deployment flow. Version 8 adds GroveBasinUnpauser, a pass-through contract that lets dedicated unpauser roles clear pause flags on a Basin without holding the full MANAGER_ADMIN_ROLE, and hardens the full-setup deployment flow of GroveBasinFactory by rejecting unsafe deployment configurations, separating the caller-selected and sequential CREATE2 salt ranges, and correcting the fee bound initialization. The latest reviewed version, Version 11, replaces the single immutable liquidity provider with a set of accounts whose deposits and withdrawals are gated per asset by the new lpAssetAllowed mapping, and introduces per user and per route swap allow list.
It is important to note that security audits are time-boxed and cannot uncover all vulnerabilities. They complement but don’t replace other vital measures to secure a project.