Test Coverage

• The instruction coverage is calculated based on source map of original program. Instructions generated for Solidity internal libraries and static/pure functions are not counted.

Vulnerabilities from Invariants Violation

Medium 00: Unable to reset protocol fee recipient once set.

Setting feeTo to zero will lead to revert of execution. Setting feeTo to address(0) is equivalent of cancel the protocol fee.

https://github.com/spearbit-audits/fuzzing-astaria-core/blob/c5890761a127e3c7624ef9d05a2382758dd65bd2/src/AstariaRouter.sol#L335

https://github.com/spearbit-audits/fuzzing-astaria-core/blob/c5890761a127e3c7624ef9d05a2382758dd65bd2/src/AstariaRouter.sol#L899

Medium 01: Low resilience against compromised auth/guardian account

If auth’d account of AstariaRouter get compromised, they can change StrategyValidator or other file to DOS an existing loan.

Guardian account has the privilege to upgraded the implementation of vaults by calling AstariaRouter.fileGuardain(File[]) with FileType.Implementation.

Under the extreme situation when guardian account is compromised, either EOA private key leaking or Multi-Sig wallet signatures leaking, the bad actor could instantly upgrade the implementation of vault to any customize contract and drain the contract without giving the service owner any timing to recover the fund or notify the users to withdraw.

Possible Mitigation

1. Add TimeLock restriction for AstariaRouter.fileGuardian

PoC of one scenario: