Security Audit Report

Blueberry Pendle Audit Report

Reviewed by: 0x52 (@IAm0x52)

Prepared For: Blueberry Finance

Review Date(s): 6/29/24 - 6/30/24

Fix Review Date(s): 6/31/24

0x52 Background

As a professional smart contract auditor, I have conducted over 100 security reviews for public and private clients. With 30+ first-place finishes in public contests on platforms like Code4rena and Sherlock, I have been recognized as a top-performing security expert. By prioritizing rigorous analysis and providing actionable recommendations, I have contributed to securing over $1 billion in TVL across 100+ protocols. Throughout my career I have collaborated with many organizations including the prestigious Blackthorn as a founding security researcher and as a Lead Security researcher at SpearbitDAO.

Protocol Summary

Blueberry Pendle integration is a leveraged yield farming system that enables users to take positions in Pendle's principal and yield tokens, utilizing specialized oracles and spell contracts to manage risk while maximizing capital efficiency.

Scope

Repo: blueberry-core

Review Hash: d0ed247

Fix Review Hash: 3b41d12

In-Scope Contracts

contracts/spell/PendleSpell.sol
contracts/oracle/PendleBaseOracle.sol
contracts/oracle/PendleLPOracle.sol
contracts/oracle/PendlePTOracle.sol

Deployment Chain(s)

Ethereum Mainnet

Summary of Findings

Finding Status Overview: 1 Fixed, 0 Unfixed
	High	Med
	0	1
	0	0

Medium Risk Findings

PT donation attack will DOS spell deposit permanently

Details

PendleSpell.sol#L128-L137

(uint256 ptAmount, , ) = IPendleRouter(_pendleRouter).swapExactTokenForPt(
    address(this),
    market,
    minPtOut,
    params,
    input,
    limitOrder
);

if (ptAmount != IERC20Upgradeable(pt).balanceOf(address(this))) revert Errors.SWAP_FAILED(pt);

After swapping from debt token to PT, the contract makes an exact check against the balance of the contract to ensure the swap executed as expected. The issue with this is that even if it is a single wei over, the contract will revert. This makes it trivial to permanently DOS opening positions via the contract by donating a small amount of PT to the contract.

Lines of Code

PendleSpell.sol#L101-L147

Recommendation

Check should be > rather than !=

Remediation

Fixed as suggested.