Trail of Bits Audit

🔧 scETH, scUSDCv2, scLUSD & sQuartz 🔧 have now been audited by Trail of Bits and launched on mainnet.

Deployment addresses

• scETH (mainnet): address, tx
• CompoundV3ScWethAdapter (mainnet): address, tx
• MorphoAaveV3ScWethAdapter (mainnet): address, tx
• AaveV3ScWethAdapter (mainnet): address, tx
• scUSDCv2 (mainnet): address, tx
• MorphoAaveV3ScUsdcAdapter (mainnet): address, tx
• AaveV2ScUsdcAdapter (mainnet): address, tx
• AaveV3ScUsdcAdapter (mainnet): address, tx
• PriceConverter (mainnet): address, tx
• Swapper (mainnet): address, tx
• scLUSD (mainnet): address, tx
• sQuartz (sepolia): address

What's Changed

• [TOB-SANDCLOCK-1] account for flashloan fees by @dxganta in #84
• [TOB-SANDCLOCK-2] derive new rewards from balance instead of user input by @brkomir in #85
• [TOB-SANDCLOCK-3/4] maintain float balance on withdrawals by @brkomir in #92
• [TOB-SANDCLOCK-5] address lido stake rate limit scenario by @dxganta in #100
• [TOB-SANDCLOCK-6] use Liquity USD/ETH dual-oracle for scLUSD by @coolhill in #101
• script for scUSDCv2 rebalancing scenarios by @brkomir in #97
• remove "slippageTolerance" from scWETHv2 constructor by @brkomir in #95
• document the decision of not including LQTY into total assets by @brkomir in #94
• move constants to Constants.sol by @brkomir in #89
• add fv report by @0xBRM in #90
• simplify reward and bonus calculations by @brkomir in #86
• rename adapters to differentiate usage between scUSDCv2 & scWETHv2 by @brkomir in #91
• deploy script for v2 vaults by @brkomir in #83
• ignore empty multi-call calldata by @brkomir in #96

Full Changelog: v0.1.2...v0.1.3

Adapters, Liquity & Staking

This pre-audit release introduces 3 new yield strategies(scLUSD, scUSDCv2, scWETHv2) and staking contracts for the Quartz token(sQuartz).

Major features

• 🛼 scUSDCv2 & scWETHv2 are lender-neutral versions of scUSDC/scWETH. They introduce adapters in order to borrow and supply from multiple lending protocols. Adapters can be added at will by a multi-sig and a keeper bot regularly rebalances the positions against a target loan to value ratio and allocation configuration in order to compound profits and/or de-risk positions.
• 🐤 scLUSD: Deposit LUSD which will be deposited into the Liquity Stability Pool. Receive scLUSD shares which appreciate over time and can be redeemed for LUSD. A keeper bot regularly reinvests profits which consists of discounted ETH on liquidations and Liquity community issuance ($LQTY). Strategy has exposure to Liquity, 0x exchange routing protocol and a combination oracle consisting of Chainlink ETH/USD and the Chainlink LUSD/USD price feeds.
• 💎 sQuartz: Deposit Quartz for sQuartz and over time claim performance fees from Sandclock yield strategies. Additionally receive bonus multiplier points (inspired by GMX reward mechanism) at 100% APR which can be compounded in order to claim a bigger portion of the staking rewards. Redeem sQuartz for Quartz at any time, which will proportionally burn some of the earned multiplier points for that account. The first 30 days of a deposit special rules apply: no additional deposits allowed and in order to withdraw/transfer a fee needs to be paid (starts at 10% of the amount and linearly decreases to zero over 30 days).

What's Changed

• add scUSDCv2 strategy by @brkomir in #58
• add scLUSD strategy by @coolhill in #77
• add scWETHv2 strategy by @dxganta in #54
• add staking contracts by @coolhill in #76

Full Changelog: v0.1.1...v0.1.2

WatchPug Audit

🔧 scWETH & scUSDC 🔧 strategies have now been audited by WatchPug and launched on mainnet. Additional internal security efforts include full unit test coverage, applying Certora formal verification on a subset of properties(scUSDC & scWETH) and running Trail of Bits pre-built echidna ERC4626 properties (report).

Deployment addresses

• scWETH (mainnet): address, tx
• scUSDC (mainnet): address, tx
• scWETH (sepolia): address, tx
• scUSDC (sepolia): address, tx

What's Changed

• [WP-C1] add flashloan initiator check by @dxganta in #62
• [WP-H2] extracted profit selling logic from rebalance into a separate function by @brkomir in #65
• [WP-M4] scUSDC rebalance ignores return value on disinvest by @brkomir in #57
• [WP-L5] fixed loss of precision for weth->usdc price calculation by @brkomir in #63
• [WP-L8] checking min balance in scUSDC on 'exitAllPositions' by @brkomir in #67
• [WP-L9] using aave api to get ltv in scUSDC & scWETH by @brkomir in #64
• simplify fee conversion by @dxganta in #47
• fix profit calculation to exclude new deposits by @coolhill in #50
• removed depositIntoStrategy, since it was redundant by @dxganta in #51
• testnet & unit test mocks by @brkomir in #56
• add fixtures to local deployment by @0xrin1 in #61
• use existing MockUSDC for goerli instead of new deploy by @0xrin1 in #59

Full Changelog: v0.1.0...v0.1.1

scWETH/scUSDC

🪃 Sandclock V2 🪃 is a set of yield strategies on mainnet, implemented as ERC4626-compliant tokenized vaults.

Major features

• scWETH - Deposit WETH/ETH and have it enter a leveraged staked ETH position with additional borrow/supply returns. Receive scWETH shares which appreciate over time when the vault is profitable and can be redeemed for WETH. A keeper bot regularly rebalances the position against a target loan to value ratio in order to compound profits or de-risk position. Strategy has exposure to Lido finance, Curve stETH-ETH LP, Balancer, Aave V3 and the Chainlink stETH/ETH price feed.
• scUSDC - Deposit USDC and over-collateralize it against WETH which will be deposited into scWETH strategy. Receive scUSDC shares which appreciate over time when the vault is profitable and can be redeemed for USDC. A keeper bot regularly rebalances the position against a target loan to value ratio in order to compound profits or de-risk position. Strategy has exposure to scWETH, Aave V3, Balancer, Uniswap V3 and the Chainlink USDC/ETH price feed.