Security review of new tokens

Over in another thread (Five new tokens to add (October 2020)) we are discussing which tokens to add to the money market protocol.

Each token that we add needs to have a security review of any token functionality that goes beyond the basic ERC20 interface. Just because a token is ERC20 compliant doesn’t mean that it can be used in Percent. There have been multiple exploits already of other protocols due to token behavior that goes beyond ERC20. The most relevant for Percent is the case of imBTC at, where re-entrancy behavior allowed an attacker to completely drain all protocol assets. (The attacker was doxxed by bad opsec and returned the funds.) Another example was the inflationary behavior of STA at Balancer.

Most of the tokens under consideration are already available in one of Compound, Aave, or Cream, which suggests they are probably safe but isn’t a guarantee. New tokens that are unique to Percent would require the most careful inspection.


The current proposal for new tokens:

proposes adding the following:


We should review each of these for compatibility with Percent’s CToken contracts. We can leverage the work done by Compound and other forks like Cream, plus related projects like Aave. We can’t give a green light just because another project supports a token, but seeing their work can help guide ours.

Where tokens are already supported:
COMP - Compound, Cream
UNI - Compound, Cream
MKR - Aave
LRC - none
sUSD - Aave
TUSD - Aave
BUSD - Aave, Cream

Looking at the token contract sources, I notice the following:








In the case of upgradable proxies, it may be possible for the owner to change the behavior of the transfer() and transferFrom() methods to arbitrary logic. This could potentially create a vulnerability like the one that affected

A token with a blacklist could block the Percent pToken supply pool from transfers, effectively seizing the tokens it contains.

I don’t see any show-stoppers, but recommend an expert Solidity dev to review each of these.

1 Like

Thank you @pyggie for the preliminary analysis, which sets the ground for someone like @splix to give his thoughts on.