Summary
The most critical subjects covered in our audit are multi-chain state consistency, functional correctness, Hyperlane integration, and frontrunning resistance.
The mechanisms ensuring consistent state across chains are robust and deliver a high level of security. The functional correctness is high as issues such as Voting period in epochs can be bypassed by using poke() have been resolved. Similarly, the integration with Hyperlane's bridging mechanism was found to be correct after issues such as Metadata Misuse in Bridges were resolved.
In the second version of the codebase, the mechanism enforcing the ordering of specific types of messages (DEPOSIT and WITHDRAW) was relaxed. This could lead the state of some contracts to be temporarily inconsistent which would lead to accounting issues (Voting power can be temporarily artificially inflated). The issue has been addressed, but it should be noted that the system relies heavily on the assumption that messages from the root to the leaf will be processed within 1 hour.
In summary, we find that the codebase provides a high level of security.
It is important to note that security audits are time-boxed and cannot uncover all vulnerabilities. They complement but don't replace other vital measures to secure a project.
About Velodrome Superchain Interoperability
Velodrome implements an expansion of Velodrome AMM system to Superchain. With this expansion, the VELO rewards and incentives become available on chains beyond Optimism with the help of Hyperlane.
"Velodrome Finance is a next-generation AMM that combines the best of Curve, Convex and Uniswap, designed to serve as the liquidity hub for the Superchain."
With a tight schedule and an important release on the line, ChainSecurity exceeded our expectations, assembling multiple internal teams and delivering a thorough, accurate report that kept us on budget and on time. We couldn’t be happier or more confident working with their team..
Velodrome Contributors