TermMax / TermMax

Within a single platform, TermMax simplifies DeFi borrowing, lending, and leveraging with one-click token trading, enabling predictable borrowing costs and stable returns. By reinventing the Uniswap V3 AMM with innovative fixed-rate mechanisms and customizable pricing curves, TermMax eliminates the need for multiple complicated transactions across different protocols, making these core DeFi functions more accessible and potentially more profitable for a wider audience.

Prize Distribution and Scoring

• Total Prize Pool: $23,000

Please note that high and medium severity findings have a separate pot for this competition and are distributed as follows:

High Severity Findings:

• Total Pot: $18,000
• Unique Reward: If 6 or fewer unique vulnerabilities are found, each valid unique vulnerability receives $3,000. If more than 6 unique vulnerabilities are found, then the standard scoring formula applies.
• Duplicates: In case of duplicates the standard scoring formula applies.

Medium Severity Findings:

• Total Pot: $5,000
• Unique Reward: If 5 or fewer unique vulnerabilities are found, each valid unique vulnerability receives $1,000. If more than 5 unique vulnerabilities are found, then the standard scoring formula applies.
• Duplicates: In case of duplicates the standard scoring formula applies.

Findings Severities described in detail on our docs page

Documentation

• https://docs.ts.finance/termmax

Scope

• Repository: https://github.com/cantina-competitions/termmax-contracts
• Total LOC: 5816
• Files:
  • contracts/

    • errors

      • FactoryErrors.sol
      • GearingTokenErrors.sol
      • MarketErrors.sol
      • OrderErrors.sol
      • RouterErrors.sol
      • VaultErrors.sol

    • events

      • FactoryEvents.sol
      • GearingTokenEvents.sol
      • MarketEvents.sol
      • OrderEvents.sol
      • RouterEvents.sol
      • VaultEvents.sol

    • factory

      • ITermMaxFactory.sol
      • IVaultFactory.sol
      • TermMaxFactory.sol
      • VaultFactory.sol

    • IFlashLoanReceiver.sol

    • ISwapCallback.sol

    • ITermMaxMarket.sol

    • ITermMaxOrder.sol

    • lib

      • ArrayUtils.sol
      • MarketConstants.sol
      • PendingLib.sol
      • TermMaxCurve.sol
      • VaultConstants.sol

    • router

      • ITermMaxRouter.sol
      • swapAdapters
        • KyberswapV2Adapter.sol
        • OdosV2Adapter.sol
      • TermMaxRouter.sol

    • storage

      • TermMaxStorage.sol

    • TermMaxMarket.sol

    • TermMaxOrder.sol

    • vault

      • IOrderManager.sol
      • ITermMaxVault.sol
      • OrderManager.sol
      • TermMaxVault.sol
      • VaultStorage.sol

Build Instructions

For build instructions, please refer to the README file in the repo.

Basic POC Test

Mandatory POC rule applies for this competition.

For POC test, you can refer to unit test in test folder as the Basic POC test framework

• test/TermMaxTestBase.t.sol

Out of scope

• Previous security reports
• Expected behaviors such as trusted/untrusted roles and/or any accepted risks
• Issues without losing fund
• Issues without authentication vulnerability
• Issues without clear poc
• Trading fluctuations that can be limited by minimum output or maximum input
• Automated findings by Lightchaser: prev comp: https://gist.github.com/ChaseTheLight01/77a9304200e34ee373dade909e5564df current comp: https://gist.github.com/ChaseTheLight01/df0c25b3ef6f239eb596f3e3a458139d

Code Walkthrough

• Live Walkthrough: Code walkthrough of TermMax

Contact Us

For any issues or concerns regarding this competition, please reach out to the Cantina core team through the Cantina Discord.