Repository navigation

Savings donation-attack guard, audits, and multi-chain upgrade deployment - #32

Merged

FabienCoutant merged 118 commits into

mainfrom

dev

Jul 30, 2026

Commits on Feb 25, 2026
- fix(issue 6): RewardHandler may revert due to receiving less than expected
  FabienCoutant
  committed
  fd74080
Commits on Feb 26, 2026
- fix(issue 9): Missing validation allows userDeviation > burnRatioDeviation, silently disabling burn ratio protection
  FabienCoutant
  committed
  bc4574a
- fix (issue 18): collatInfo.stablecoinCap hardcap can be bypassed via SettersGovernor::adjustStablecoins
  FabienCoutant
  committed
  7df01b8
- fix(issue 16): SettersGovernor::setWhitelistStatus allows values other than 0 and 1 potentially leading to DOS
  FabienCoutant
  committed
  3010a17
- fix(issue 19): Incorrect link to Angle contracts across protocol
  FabienCoutant
  committed
  08bc292
- fix(issue 20): Deploy script UpdateParallelizer.ts does not handle facet removal case
  FabienCoutant
  committed
  c340795
Commits on Feb 27, 2026
- fix(issue 11): LibHelpers.convertDecimalsTo favours the user on a exact-out mint and burn for certain collateral decimals
  FabienCoutant
  committed
  f60101a
Commits on Mar 1, 2026
- fix(issue 26): Oracle Inconsistency between surplus computation and post-check causes Surplus::processSurplus(collateralAddress,0) DoS
  FabienCoutant
  committed
  7d9d712
- fix(test): update SafeCast error format in BurnGetCollateralRatio fuzz test
  FabienCoutant
  committed
  84785b1
- fix(issue 29): LibSurplus::_computeCollateralSurplus doesn't account for surplusBufferRatio > 100%
  FabienCoutant
  committed
  3d5bb19
- style: fix max-line-length lint errors in Swapper.sol and Redeem.t.sol
  FabienCoutant
  committed
  7c9d01b
- fix(ci): pin OpenZeppelin dependencies to 5.4.0
  FabienCoutant
  committed
  130d731
Commits on Mar 3, 2026
- fix: update surplus buffer ratio handling and introduce new error for unset ratio
  FabienCoutant
  committed
  27e8857
Commits on Mar 4, 2026
- fix(LibSetters): adjust normalized stablecoin cap check to account for normalizer (amends issue 18)
  FabienCoutant
  committed
  f41738d
- fix(LibSurplus): cap per-collateral surplus by global surplus to ensure protocol remains above buffer ratio
  FabienCoutant
  committed
  60fec2c
- refactor(RewardHandler, LibSetters, tests): remove unused variables and streamline loops for improved clarity and efficiency
  FabienCoutant
  committed
  1fa2ace
- test(Parallelizer): add surplus cap tests for global CR below buffer ratio
  FabienCoutant
  committed
  c832d82
Commits on Mar 5, 2026
- feat(audits): add new audit document for Cyfrin Parallel Protocol dated 2026-03-04
  FabienCoutant
  committed
  e70a4c2
Commits on Mar 8, 2026
- feat(audits): add Cyfrin's formal verification of Parallel Protocol dated 2026-03-04
  FabienCoutant
  committed
  2de78d6
Commits on Mar 9, 2026
- Merge pull request #18 from parallel-protocol/audit/cyfrin-february-2026
  FabienCoutant
  authored
  0f92ecb
Commits on Mar 31, 2026
- refacto(Surplus): update SurplusProcessed event to include collateral address for better tracking
  FabienCoutant
  committed
  c93b671
- feat(Parallelizer): add "Surplus" to facets list
  FabienCoutant
  committed
  db154ca
Commits on Apr 1, 2026
- fix(Swapper): revert when burning all stablecoin issued
  FabienCoutant
  committed
  3e40b10
Commits on Apr 2, 2026
- fix(Getters): use Floor rounding for stablecoinsIssued to prevent burning all stables
  FabienCoutant
  committed
  19d160d
- test(Burn,Redeem): add comprehensive fuzz tests for CannotBurnAllStableIssued
  FabienCoutant
  committed
  2d346ca
- style(Swapper): fix trailing whitespace and formatting
  FabienCoutant
  committed
  1f154fb
- fix(tests): skip reentrancy tests when burning all stables and fix formatting
  FabienCoutant
  committed
  acf8c1d
- style: fix formatting in Swap tests and regenerate artifacts
  FabienCoutant
  committed
  ca5b768
Commits on Apr 3, 2026
- fix(Redeemer): guard normalizedStables on redeem path per whitehat recommendation
  FabienCoutant
  committed
  1143ad3
Commits on Apr 5, 2026
- style(Redeem): wrap long assertGt message to satisfy max-line-length
  FabienCoutant
  committed
  a3269e8
Commits on Apr 6, 2026
- Revert "fix(Getters): use Floor rounding for stablecoinsIssued to prevent burning all stables"
  FabienCoutant
  committed
  4c4f074
- Merge pull request #19 from parallel-protocol/hotfix/fees-bypass-enable-attackers-extract-high-quality-collateral
  FabienCoutant
  authored
  cb9fe3f
- feat(EIP3009): add interface, abstract implementation, and test infrastructure
  FabienCoutant
  committed
  8d88dc0
- feat(Swapper,Redeemer): add EIP-3009 swap and redeem with authorization
  FabienCoutant
  committed
  2b57e90
- feat(Savings): integrate EIP-3009 for shares token and deposits
  FabienCoutant
  committed
  860803a
- fix(EIP3009): fix lint line-length errors and stack-too-deep in Redeemer
  FabienCoutant
  committed
  7ee983c
Commits on Apr 7, 2026
- Merge branch 'hotfix/fees-bypass-enable-attackers-extract-high-quality-collateral' into audit/eip3009-hotfix-fees
  FabienCoutant
  committed
  5bac098
- Merge branch 'feat/eip3009' into audit/eip3009-hotfix-fees
  FabienCoutant
  committed
  637138f
Commits on Apr 10, 2026
- refactor: clean EIP3009 and avoid front-run tx
  FabienCoutant
  committed
  ff37fd5
- refactor(tests): implement try/catch for quoteRedemptionCurve in Burn and Redeem tests
  FabienCoutant
  committed
  d23f7d7
- fix(Parallelizer): bind swap/redeem intent to EIP-3009 nonce to prevent front-running
  FabienCoutant
  committed
  c9e5321
- fix(lint): wrap typehash strings to satisfy max-line-length
  FabienCoutant
  committed
  1d0a466
- fix(tests): use methodIdentifiers JSON to derive selectors
  FabienCoutant
  committed
  a9d7683
Commits on Apr 27, 2026
- add(audits): include first report for Bailsec - Parallel Protocol Upgrade V3.2
  FabienCoutant
  committed
  28af0cf
- fix(Swapper) [Issue_05]: assert balance delta on receiveWithAuthorization to block silent no-op tokens
  FabienCoutant
  committed
  d955bcc
- fix(Parallelizer) [Issue_06]: accept arbitrary-length signatures in AuthorizationParams to support EIP-1271
  FabienCoutant
  committed
  4323528
- fix(Parallelizer) [Issue_07]: attribute Swap and Redeemed events to authorizer instead of relayer
  FabienCoutant
  committed
  cf63107
- fix(Swapper) [Issue_08]: consume nonce on zero-amount authorized swaps to prevent replay
  FabienCoutant
  committed
  97bede5
- fix(Redeemer) [Issue_09]: expose forfeitTokens in redeemWithAuthorization to unblock gasless redeems on whitelist-gated collateral
  FabienCoutant
  committed
  9d4072a
- refactor(Authorization): replace keccak256 typehash strings with precomputed values for efficiency
  FabienCoutant
  committed
  2955661
- fix(EIP3009) [Issue_02]: align storage slot with EIP-7201 derivation of cooperlabs.storage.EIP3009 namespace
  FabienCoutant
  committed
  4bd346c
- docs(EIP3009) [Issue_01]: warn that transferWithAuthorization must not back flows with post-transfer logic due to nonce-burn frontrunning
  FabienCoutant
  committed
  55c5e09
Commits on Apr 28, 2026
- fix(facets): refactor Swapper and Redeemer to compile under CI profile (no via-IR)
  FabienCoutant
  committed
  4b50eca
Commits on May 5, 2026
- add(audits): include final report for Bailsec - Parallel Protocol Upgrade V3.2
  FabienCoutant
  committed
  6f7db3d
- fix(invariants): switch BurnExactOutput cap branch to exact-input semantics
  FabienCoutant
  committed
  d8738ee
- fix(invariants): populate forfeitTokens in ArbitragerWithSplit.redeem
  FabienCoutant
  committed
  6f27971
- ci: pin Foundry to v1.5.1 across build and test jobs
  FabienCoutant
  committed
  93f19ae
- Merge pull request #23 from parallel-protocol/audit/bailsec-april-2026-eip3009-hotfix-fees
  FabienCoutant
  authored
  a487047
Commits on May 18, 2026
- add(audits): include final report for Cyfrin - Parallel Protocol Upgrade V3.2
  FabienCoutant
  committed
  3caaa8c
- fix(Savings) [Cyfrin-L1]: validate divizer and name/symbol in initialize to preserve dead-share moat
  FabienCoutant
  committed
  b4a854a
- fix(Savings) [Cyfrin-I3]: override max* views to return 0 when paused for ERC4626 compliance
  FabienCoutant
  committed
  d191c62
- fix(ISavings) [Cyfrin-I4]: drop orphan initializeEIP3009 declaration
  FabienCoutant
  committed
  a11c8bf
- docs(Redeemer) [Cyfrin-I6]: document entry-time penaltyFactor evaluation invariant on _quoteRedemptionCurve
  FabienCoutant
  committed
  97680d2
- fix(Savings) [Cyfrin-I1]: accrue and clamp rate in setMaxRate to keep rate <= maxRate invariant
  FabienCoutant
  committed
  d3e4824
- fix(Savings) [Cyfrin-I2]: accrue yield on togglePause transitions to remove stale-window deferral
  FabienCoutant
  committed
  671e1e8
Commits on May 27, 2026
- docs(audits): add Cyfrin v3.2 1st + final reports
  FabienCoutant
  committed
  9d04fd3
- Merge pull request #24 from parallel-protocol/audit/cyfrin-may-2026-eip3009-hotfix-fees
  FabienCoutant
  authored
  a5cd5c0
- Merge pull request #21 from parallel-protocol/audit/eip3009-hotfix-fees
  FabienCoutant
  authored
  14053df
- chore(foundry): default to via_ir = false
  FabienCoutant
  committed
  5b012cf
- refacto(utils): add SECONDS_PER_YEAR constant and Pause errors
  FabienCoutant
  committed
  30f7d5c
- refacto(parallelizer): split togglePause into pause and unpause
  FabienCoutant
  committed
  f363ab2
- chore(foundry): default to via_ir = false
  FabienCoutant
  committed
  f437867
- refacto(utils): add SECONDS_PER_YEAR constant and Pause errors
  FabienCoutant
  committed
  b3a581e
- fix(savings): track storedAssets to prevent donation attacks
  FabienCoutant
  committed
  d85eb84
- test(savings): cover donation attacks, recoverSurplus and upgrade path
  FabienCoutant
  committed
  64923d1
- Merge pull request #25 from parallel-protocol/refactor/parallelizer-pause
  FabienCoutant
  authored
  a1204e1
- Merge pull request #26 from parallel-protocol/fix/savings-donation-attack
  FabienCoutant
  authored
  4baa958
- style(savings): wrap long abi.encodeWithSelector line to satisfy solhint max-line-length
  FabienCoutant
  committed
  ad83408
- Merge lint fix from fix/savings-donation-attack
  FabienCoutant
  committed
  6d5d279
- test(invariants): stabilize path-independence vs intended I-6 path dependence
  FabienCoutant
  committed
  1953ce3
- Merge path-independence invariant stabilization from test/path-independence-tolerance
  FabienCoutant
  committed
  8f47e85
- test(invariants): widen path-independence tolerances for intended I-6 path dependence
  FabienCoutant
  committed
  b32a75c
- fix(invariants): drop redeem bound (stack), keep widened path-independence tolerances
  FabienCoutant
  committed
  2310b90
- chore: remove accidentally committed local script AddCollateralMUSDC
  FabienCoutant
  committed
  8a9c2ac
- Merge pull request #28 from parallel-protocol/test/path-independence-tolerance
  FabienCoutant
  authored
  cc9adda
- Merge dev (path-independence tolerance fix #28) into integration branch
  FabienCoutant
  committed
  7c24bc4
Commits on Jun 5, 2026
- docs(audits): add Cyfrin Parallel Savings Fix 1st report
  FabienCoutant
  committed
  33b7a00
- fix(Savings) [Cyfrin-I4]: set lastUpdate in initialize to bound first accrual window
  FabienCoutant
  committed
  7468f4e
- fix(Savings) [Cyfrin-I3]: restrict initializeStoredAssets to governance
  FabienCoutant
  committed
  fcbc460
- fix(Savings) [Cyfrin-L1]: bound storedAssets seeding to a lastUpdate freshness window
  FabienCoutant
  committed
  ed6ae54
- fix(Savings) [Cyfrin-L2]: drop paused interval on unpause so pausing halts yield
  FabienCoutant
  committed
  0e81ba4
Commits on Jun 10, 2026
- docs(audits): add Cyfrin Parallel Savings Fix final report
  FabienCoutant
  committed
  ec66a0d
- Merge pull request #29 from parallel-protocol/audit/cyfrin-june-2026-savings-donation
  FabienCoutant
  authored
  61942aa
Commits on Jun 26, 2026
- docs(audits): add Bailsec Parallel Savings Fix 1st report
  FabienCoutant
  committed
  011211f
- fix(Savings) [Bailsec-01]: grant initializeStoredAssets selector to governor for atomic upgrade
  FabienCoutant
  committed
  c078aea
- fix(Savings) [Bailsec-02]: re-anchor lastUpdate in initializeStoredAssets
  FabienCoutant
  committed
  90428c0
- fix(Savings) [Bailsec-03]: return storedAssets from totalAssets while paused
  FabienCoutant
  committed
  a3c5530
- fix(Savings) [Bailsec-04]: skip accrual while paused so rate setters cannot mint paused yield
  FabienCoutant
  committed
  c4aebc2
- fix(Savings) [Bailsec-05]: enforce ERC4626 max checks in deposit/mint/withdraw/redeem
  FabienCoutant
  committed
  d87db00
- fix(Savings) [Bailsec-07]: guard entry points against uninitialized storedAssets after non-atomic upgrade
  FabienCoutant
  committed
  1276221
Commits on Jul 6, 2026
- fix(Savings) [Bailsec-05]: extend ERC4626 max checks to EIP-3009 authorized deposit/redeem
  FabienCoutant
  committed
  f0dde86
Commits on Jul 13, 2026
Commits on Jul 22, 2026
- chore(deps): migrate to rocketh 0.19 and hardhat-deploy 2
  FabienCoutant
  committed
  cf4d314
- fix(build): disable viaIR to keep facets under the EIP-170 limit
  FabienCoutant
  committed
  d554f28
- feat(roles): move surplus operations to a keeper role
  FabienCoutant
  committed
  7072307
- feat(getters): expose the surplus buffer ratio
  FabienCoutant
  committed
  e6f9b13
- feat(deploy): add upgrade scripts for the facets and the savings implementation
  FabienCoutant
  committed
  ce69b96
- chore(generated): drop the artifact outputs orphaned by hardhat-deploy 2
  FabienCoutant
  committed
  3d25236
- chore(deployments): record the sonic upgrade deployment
  FabienCoutant
  committed
  4326504
- chore(generated): track the compiled abis
  FabienCoutant
  committed
  7ff8a57
Commits on Jul 24, 2026
- docs(audits): add the Cyfrin formal verification report for the savings fix
  FabienCoutant
  committed
  8dda041
- chore(deployments): record the base upgrade deployment
  FabienCoutant
  committed
  351e721
- chore(deployments): record the avalanche upgrade deployment
  FabienCoutant
  committed
  111e2d5
Commits on Jul 30, 2026
- chore(deployments): record the mainnet upgrade deployment
  FabienCoutant
  committed
  1d47b4a
- chore(deployments): record the hyperevm upgrade deployment
  FabienCoutant
  committed
  e04f1a4
- chore(release): set version to 3.2.1
  FabienCoutant
  committed
  0ce59af

Commits

Commits on Feb 25, 2026

Commits on Feb 26, 2026

Commits on Feb 27, 2026

Commits on Mar 1, 2026

Commits on Mar 3, 2026

Commits on Mar 4, 2026

Commits on Mar 5, 2026

Commits on Mar 8, 2026

Commits on Mar 9, 2026

Commits on Mar 31, 2026

Commits on Apr 1, 2026

Commits on Apr 2, 2026

Commits on Apr 3, 2026

Commits on Apr 5, 2026

Commits on Apr 6, 2026

Commits on Apr 7, 2026

Commits on Apr 10, 2026

Commits on Apr 27, 2026

Commits on Apr 28, 2026

Commits on May 5, 2026

Commits on May 18, 2026

Commits on May 27, 2026

Commits on Jun 5, 2026

Commits on Jun 10, 2026

Commits on Jun 26, 2026

Commits on Jul 6, 2026

Commits on Jul 13, 2026

Commits on Jul 22, 2026

Commits on Jul 24, 2026

Commits on Jul 30, 2026