Security & Audits

At Venus, our utmost dedication lies in ensuring the highest levels of security for our users. Throughout the entire Smart Contract development lifecycle, we strictly adhere to industry best practices to uphold the integrity of our platform. To further fortify our security measures, we collaborate with renowned auditing firms in the field. These partnerships enable us to conduct comprehensive security assessments of our protocol, thereby safeguarding our users' funds effectively.

The security of the Venus Protocol stands as our highest priority. Our development team, in conjunction with third-party auditors and consultants, has invested substantial efforts to create a protocol that we confidently deem safe and dependable. We prioritize transparency by making all contract code and balances publicly verifiable. Moreover, we offer a bug bounty program to security researchers who report undiscovered vulnerabilities, encouraging continuous improvement and vigilance.

We firmly believe that the true test of a smart contract's security lies in its size, visibility, and time. Consequently, we urge users to exercise caution and make independent assessments of the security and suitability of our protocol.

Audits

VAI Controller

Scope: VAIController contract, fixing how the seized amounts during a VAI liquidations are calculated, considering the original VAI debt plus the interests generated.

• Certik audit audit report (2024/04/26)

• Pessimistic audit audit report (2024/05/02)

• Fairyproof audit audit report (2024/04/18)

Detailed scope

• Pull request #467

  • contracts/Tokens/VAI/VAIController.sol

XVS bridge - Mesh architecture

Scope: enable XVS transfers between networks different to the BNB Chain, for example, between Ethereum mainnet and opBNB mainnet. Detailed scope. Enabled in VIP-292.

• Certik audit audit report (2024/04/19)

Correlated token oracles

Scope: set of oracles for tokens whose price is highly correlated with the price of another token. This definition includes Liquid Staked Tokens (like wsETH, weETH, WBETH, ankrBNB, BNBx, slisBNB, stkBNB), ERC-4226 tokens (like sFRAX, sfrxETH) and any token covertible to other token onchain (like the Pendle PT tokens). WeETHOracle enabled in VIP-290. AnkrBNBOracle, BNBxOracle, SlisBNBOracle and StkBNBOracle enabled in VIP-293.

• Certik audit audit report (2024/04/12)

• Quantstamp audit audit report (2024/04/12)

• Fairyproof audit audit report (2024/03/28)

Detailed scope

• Pull request #165

  • contracts/oracles/AnkrBNBOracle.sol

  • contracts/oracles/BNBxOracle.sol

  • contracts/oracles/OneJumpOracle.sol

  • contracts/oracles/PendleOracle.sol

  • contracts/oracles/SFraxOracle.sol

  • contracts/oracles/SFrxETHOracle.sol

  • contracts/oracles/SlisBNBOracle.sol

  • contracts/oracles/StkBNBOracle.sol

  • contracts/oracles/WBETHOracle.sol

  • contracts/oracles/WeETHOracle.sol

  • contracts/oracles/WstETHOracle.sol

  • contracts/oracles/common/CorrelatedTokenOracle.sol

Native token gateway

Scope: NativeTokenGateway contract, that facilitates the interaction (borrow, supply, repay and redeem) with markets where the underlying token is a wrapped version of the native token (for example WETH on Ethereum, or BNB on BNB chain). Enabled in VIP-276.

• Certik audit audit report (2024/02/26)

• Pessimistic audit audit report (2024/02/29)

• Quantstamp audit audit report (2024/03/01)

Detailed scope

• Pull request #361

  • contracts/Comptroller.sol

  • contracts/ComptrollerStorage.sol

  • contracts/Gateway/Interfaces/IVtoken.sol

  • contracts/Gateway/Interfaces/IWrappedNative.sol

  • contracts/Gateway/NativeTokenGateway.sol

  • contracts/VToken.sol

  • contracts/VTokenInterfaces.sol

• Pull request #442

  • contracts/Tokens/VTokens/VBep20.sol

  • contracts/Tokens/VTokens/VToken.sol

  • contracts/Comptroller/Diamond/facets/MarketFacet.sol

Oracle for wstETH

Scope: Oracle for wstETH, using the exchange rate wstETH/stETH from the stETH contract on Ethereum, assuming 1:1 for the conversion rate stETH:ETH, and converting ETH to USD using the Resilient Oracles.

• Certik audit audit report (2024/01/26)

• Quantstamp audit audit report (2024/02/20)

Detailed scope

• Pull request #155 in the oracle repo

  • contracts/oracles/WstETHOracle.sol

Token converters

Scope: Token converter contracts. These contracts will allow the protocol to convert the income generated to the needed tokens, following the Tokenomics. Enabled in VIP-245 and VIP-248.

• Token converters

  • OpenZeppelin audit report (2023/10/10)

  • Certik audit audit report (2023/11/07)

  • Peckshield audit report (2023/09/27)

  • Fairyproof audit report (2023/08/28)

• Private conversions (optimization to avoid the payment of incentives to third parties when the conversion can be completed internally)

  • Certik audit report (2023/11/27)

  • Certik audit addendum (2024/02/15)

  • OpenZeppelin report (2024/01/09)

  • OpenZeppelin addendum (2024/02/20)

Detailed scope

• Pull request #9 in the protocol-reserve repo.

  • contracts/TokenConverter/AbstractTokenConverter.sol

  • contracts/TokenConverter/IAbstractTokenConverter.sol

  • contracts/TokenConverter/RiskFundConverter.sol

  • contracts/TokenConverter/XVSVaultConverter.sol

  • contracts/ProtocolReserve/RiskFundStorage.sol

  • contracts/ProtocolReserve/RiskFundV2.sol

  • contracts/ProtocolReserve/XVSVaultTreasury.sol

  • contracts/Utils/Constants.sol

  • contracts/Utils/Validators.sol

• Pull request #35 in the protocol-reserve repo.

  • contracts/Interfaces/IConverterNetwork.sol

  • contracts/TokenConverter/AbstractTokenConverter.sol

  • contracts/TokenConverter/ConverterNetwork.sol

  • contracts/TokenConverter/IAbstractTokenConverter.sol

  • contracts/TokenConverter/RiskFundConverter.sol

  • contracts/TokenConverter/SingleTokenConverter.sol

  • contracts/Utils/ArrayHelpers.sol

XVS bridge and multichain deployment

Scope: token-bridge repository, with contracts to allow the bridge of XVS tokens from/to BNB to/from other EVM compatible networks, like Ethereum. Extend the OFTV2 LayerZero contracts, adding custom security rules. XVS and TokenController contract, to be used on the destination chains (initially Ethereum mainnet, Arbitrum one, Polygon zkEVM and opBNB). Moreover, the audit scope included: a new VTreasuryV8 contract, and changes in the Resilient Oracle and Isolated pools](https://github.com/VenusProtocol/isolated-pools/pull/294) to make them compatible with other networks. Enabled in VIP-232.

• Certik audit report (2023/12/26)

• Quantstamp audit report (2023/12/19)

• Peckshield audit report (2023/10/20)

Detailed scope

• Certik, Quantstamp and Peckshield audited:

  • token-bridge repository

  • Branch: develop

  • Last commit: 91b640fffb0c374bdb63a0f6e8e756793e892ad6

  • List of files in the scope:

    • contracts/Bridge/BaseXVSProxyOFT.sol

    • contracts/Bridge/XVSBridgeAdmin.sol

    • contracts/Bridge/XVSProxyOFTDest.sol

    • contracts/Bridge/XVSProxyOFTSrc.sol

    • contracts/Bridge/token/TokenController.sol

    • contracts/Bridge/token/XVS.sol

    • contracts/Bridge/interfaces/IXVSProxyOFT.sol

    • contracts/Bridge/interfaces/IXVS.sol

• Moreover, Peckshield audited this:

  • https://github.com/VenusProtocol/venus-protocol/pull/345

    • This is the treasury contract used in the different networks

    • Inspired by the VTreasury contract deployed to BNB chain (solidity 0.5.16, here)

    • Main chain: adapted to solidity 0.8.20

    • Last commit: 0a058575a48b3b1d55cf257f2ade768b749f0fc6

  • Resilient Oracles change

    • https://github.com/VenusProtocol/oracle/pull/124

      • Rename variables related to the native token on each chain and the VAI token

    • Last commit: a0a36bcd94e5acd41e137e3cef711484f86eb397

• Apart from the previous scopes, Quantstamp also audited:

  • Isolated pools change

    • https://github.com/VenusProtocol/isolated-pools/pull/294

      • Convert into immutable the number of blocks per year, so it can be configured per chain during the deployment

    • Last commit: 5e660bffec987b3d31aba3f11b5c4e35f689f646

  • XVSVault

    • https://github.com/VenusProtocol/venus-protocol/tree/develop/contracts/XVSVault

    • Last commit: a158f8c335d0cfad71f1d2c27af6b0d92f4abe41

  • Protocol Share Reserve

    • https://github.com/VenusProtocol/protocol-reserve/blob/develop/contracts/ProtocolReserve/ProtocolShareReserve.sol

    • Last commit: e396119c4442b7811fbeb14ad0851afec1a9d0fa

  • Access Control Manager

    • https://github.com/VenusProtocol/governance-contracts/blob/main/contracts/Governance/AccessControlManager.sol

    • Last commit: 358bed476af7d7d871bf59e77c9daba22a7c2339

Venus Prime

Scope: Prime and PrimeLiquidityProvider contracts, to manage the eligibility of Prime tokens and the rewards distributions.

Enabled in VIP-201, VIP-202, VIP-203, VIP-206 and VIP-210. Updated in VIP-225.

• OpenZeppelin audit report (2023/10/03)

• Certik audit audit report (2023/11/13)

• Peckshield audit report (2023/08/26)

• Fairyproof audit report (2023/09/10)

• Code4rena contest (2023/09/28)

• Certik audit audit report (2023/12/19) - Venus Prime update

  • Allow mint VAI only to Prime holder

  • Support for Isolated pools

  • Support for networks without a constant block rate (for example, Arbitrum)

Detailed scope

• Pull request #196 in the core pool repo.

  • Prime feature:

    • contracts/Tokens/Prime/IPrime.sol

    • contracts/Tokens/Prime/Prime.sol

    • contracts/Tokens/Prime/PrimeStorage.sol

    • contracts/Tokens/Prime/PrimeLiquidityProvider.sol

  • Comptroller integration:

    • contracts/Comptroller/ComptrollerStorage.sol

    • contracts/Comptroller/Diamond/facets/PolicyFacet.sol

    • contracts/Comptroller/Diamond/facets/SetterFacet.sol

  • XVSVault integration:

    • contracts/XVSVault/XVSVault.sol

    • contracts/XVSVault/XVSVaultStorage.sol

  • Libs:

    • contracts/Tokens/Prime/libs/Scores.sol

    • contracts/Tokens/Prime/libs/FixedMath.sol

    • contracts/Tokens/Prime/libs/FixedMath0x.sol

• Venus Prime update. Enabled in VIP-225.

  • Pull request #407

    • contracts/Tokens/Prime/IPrime.sol

    • contracts/Tokens/Prime/Interfaces/IPrime.sol

    • contracts/Tokens/Prime/Prime.sol

    • contracts/Tokens/Prime/PrimeLiquidityProvider.sol

    • contracts/Tokens/Prime/PrimeStorage.sol

    • contracts/Utils/TimeManager.sol

    • contracts/Tokens/VAI/VAIController.sol

    • contracts/Tokens/VAI/VAIControllerStorage.sol

  • Pull request #327

    • contracts/Comptroller.sol

    • contracts/ComptrollerStorage.sol

    • contracts/VToken.sol

Automatic income allocation

Scope: Changes in the VToken contracts of the Core and IL pools (including the VBNB market), to send automatically the interest reserves to the new ProtocolShareReserve contract, where configured rules will distribute the income following the tokenomics of the project. Enabled in VIP-189, VIP-192, VIP-193 and VIP-194.

• Quantstamp audit report (2023/09/13)

• Certik audit audit report (2023/09/12)

• Peckshield audit report (2023/08/12)

• Fairyproof audit report (2023/08/03)

Detailed scope

• Core pool - interest reserves:

  • Pull request: https://github.com/VenusProtocol/venus-protocol/pull/262

  • Files:

    • contracts/Tokens/VTokens/VToken.sol

    • contracts/Tokens/VTokens/VTokenInterfaces.sol

    • contracts/Utils/ErrorReporter.sol

• Harvesting BNB income:

  • Pull request: https://github.com/VenusProtocol/venus-protocol/pull/289

  • Files:

    • contracts/Admin/VBNBAdmin.sol

    • contracts/Admin/VBNBAdminStorage.sol

• Isolated pools - Liquidations & interest reserves:

  • Pull request: https://github.com/VenusProtocol/isolated-pools/pull/207

  • Files:

    • contracts/VToken.sol

    • contracts/VTokenInterfaces.sol

• Distribute the collected incomes - ProtocolShareReserve contract

  • Branch develop in the repo https://github.com/VenusProtocol/protocol-reserve. Last commit to consider: dfb653d2e3fe163a248bbd9f8951cd6b96b06390

  • Files:

    • contracts/ProtocolReserve/ProtocolShareReserve.sol

    • contracts/Interfaces/IIncomeDestination.sol

    • contracts/Interfaces/IPrime.sol

    • contracts/Interfaces/IProtocolShareReserve.sol

    • contracts/Interfaces/IVToken.sol

    • contracts/Interfaces/ComptrollerInterface.sol

    • contracts/Interfaces/PoolRegistryInterface.sol

Diamond Comptroller

Scope: Upgrade of the Comptroller contract in the Core pool, implementing the Diamond pattern. Enabled in the VIP-174.

• Fairyproof audit report (2023/06/25)

• Peckshield audit report (2023/07/28)

• Certik audit audit report (2023/08/03)

• OpenZeppelin audit report (2023/08/17)

• Quantstamp audit audit report (2023/09/20)

Detailed scope

Code to be audited: https://github.com/VenusProtocol/venus-protocol/pull/224 Last commit: 331394866b0b78ea3b65efe03931acd582d0382e Files in the scope of the audit:

• contracts/Comptroller/ComptrollerStorage.sol

• contracts/Comptroller/Diamond/Diamond.sol

• contracts/Comptroller/Diamond/facets/FacetBase.sol

• contracts/Comptroller/Diamond/facets/MarketFacet.sol

• contracts/Comptroller/Diamond/facets/PolicyFacet.sol

• contracts/Comptroller/Diamond/facets/RewardFacet.sol

• contracts/Comptroller/Diamond/facets/SetterFacet.sol

• contracts/Comptroller/Diamond/facets/XVSRewardsHelper.sol

• contracts/Comptroller/Diamond/interfaces/IDiamondCut.sol

• contracts/Comptroller/Diamond/interfaces/IMarketFacet.sol

• contracts/Comptroller/Diamond/interfaces/IPolicyFacet.sol

• contracts/Comptroller/Diamond/interfaces/IRewardFacet.sol

• contracts/Comptroller/Diamond/interfaces/ISetterFacet.sol

• contracts/Lens/ComptrollerLens.sol

• contracts/Lens/SnapshotLens.sol

BUSDLiquidator

Scope: Contract to forcibly liquidate BUSD positions after enabling the "forced liquidations" feature in the BUSD market, in the VIP-191

• Peckshield audit report (2023/10/20)

Detailed scope

Code to be audited: https://github.com/VenusProtocol/venus-protocol/pull/362 Last commit: 592b022723740c6b7b066445f407f12253d85637

Forced liquidations in the Isolated pools

Scope: Upgrade of the Comptroller contract in the Isolated pools, adding the "forced liquidations" feature, enabled on VIP-186

• Certik audit report (2023/10/16)

Forced liquidations in the Core pool

Scope: Upgrade of the Comptroller contract in the Core pool, adding the "forced liquidations" feature, enabled on VIP-172

• Certik audit report (2023/09/16)

• Peckshield audit report (2023/09/16)

RiskFund and Shortfall handling

Scope: RiskFund, Shortfall and ProtocolShareReserve contracts in the isolated-pools repo, enabled on VIP-170

These contracts were in the scope of the audits done before the launch of Isolated Pools in the VIP-134. Some upgrades were done on these contracts, and a new round of audits were done focused on these changes.

• Certik audit report - 2023/08/24

• Peckshield audit report - 2023/08/25

Peg Stability Module (PSM)

Scope: Peg Stability Module contract for VAI/USDT, enabled on VIP-157

• Quantstamp audit report - 2023/08/07

• Certik audit report - 2023/05/24

• Peckshield audit report - 2023/04/26

• Hacken audit report - 2023/06/26

Oracles upgrade (2023/07/24)

Scope: Upgrade of the Resilient Price Feeds, enabled on VIP-145.

• Peckshield audit report - 2023/07/12

• Certik audit report - 2023/07/17

Oracles

Scope: New Resilient Price Feeds, enabled on VIP-123.

• OpenZeppeling audit report - 2023/06/06

• Peckshield audit report - 2023/04/24

• Certik audit report - 2023/05/22

• Hacken audit report - 2023/04/26

• HashEx vulnerability report - 2024/02/01. No risks, because the TWAP oracle is not used at all by the Venus Protocol. The TwapOracle is removed from the repository to avoid any confusion.

Vaults

Scope: Upgrade of the XVSVault, VAIVault and VRTVault, enabled on VIP-127.

• Quantstamp audit report - 2023/05/19

• Peckshield audit report 1 - 2023/03/22

• Peckshield audit report 2 - 2023/04/19

• Fairyproof audit report - 2023/05/17

• Certik audit report - 2023/06/04

Isolated pools

Scope: Isolated pools, first enabled on VIP-134.

• Certik audit report

• Certik audit report (RewardsDistributor)

• Peckshield audit report 1

• Peckshield audit report 2

• Hacken audit report

• Code4rena contest - 2023/05/15

Automatic Income Allocation in the Liquidator contract

Scope: Integration of the Automatic Income Allocation into the Liquidator contract used in the Core pool on BNB chain.

• OpenZeppelin audit report (2023/July/20)

• Quantstamp audit report (2023/July/17)

• Certik audit report (2023/July/4)

• Peckshield audit report (2023/July/5)

Detailed scope

• Pull request #241 in the venus-protocol repo.

  • contracts/Liquidator/Liquidator.sol

  • contracts/Liquidator/LiquidatorStorage.sol

Swap router

Scope: SwapRouter contract, enabled on VIP-131.

• OpenZeppelin audit report - 2023/06/16

• Certik audit report - 2023/05/30

• Peckshield audit report - 2023/04/19

• Hacken audit report - 2023/06/28

VToken

Scope: Delegate Borrowing in Venus. Upgrade of BUSD, USDC, USDT, BTCB and ETH markets, to reduce the risks on Venus that resulted from the September 2022 BNB Bridge incident. Executed on VIP-99.

• Peckshield audit report - 2023/02/27