JustFlash Protocol - Security Documentation

Overview

Security Architecture

Core Security Features

1. Reentrancy Protection

contract FlashLoanPool is ReentrancyGuard {
 function flashLoan(...) external nonReentrant { ... }
 function deposit(...) external nonReentrant { ... }
 function withdraw(...) external nonReentrant { ... }
}

2. Checks-Effects-Interactions Pattern

function flashLoan(...) external nonReentrant {
 // CHECKS: Validate inputs
 if (amount == 0) revert ZeroAmount();
 if (!_supportedTokens[token]) revert TokenNotSupported(token);
 
 // EFFECTS: Update state
 uint256 premium = calculatePremium(amount);
 uint256 preBalance = getBalance();
 
 // INTERACTIONS: External calls last
 token.transfer(receiver, amount);
 receiver.executeOperation(...);
 token.transferFrom(receiver, address(this), amountOwed);
}

3. Token Whitelist

mapping(address => bool) private _supportedTokens;
function whitelistToken(address token) external onlyOwner {
 _supportedTokens[token] = true;
}

4. Balance Verification

uint256 postBalance = token.balanceOf(address(this));
if (postBalance < preBalance + premium) {
 revert FlashLoanRepaymentFailed(...);
}

5. Access Control

function setFlashLoanFee(uint256 newFee) external onlyOwner { ... }
function whitelistToken(address token) external onlyOwner { ... }
function setFeeCollector(address collector) external onlyOwner { ... }

Attack Vector Analysis

Known Limitations

1. Oracle Dependency

2. Admin Privileges

3. Centralization Risk

Audit Status

Recommended Audit Process

Recommended Auditors

Bug Bounty Program

Proposed Bounty Structure

Scope

Security Best Practices for Integrators

1. Always Verify the Caller

function executeOperation(...) external returns (bool) {
 require(msg.sender == FLASH_LOAN_POOL, "Unauthorized");
 // ...
}

2. Use SafeERC20

using SafeERC20 for IERC20;
// Instead of
token.transfer(to, amount);
// Use
token.safeTransfer(to, amount);

3. Validate All Inputs

require(amount > 0, "Zero amount");
require(receiver != address(0), "Zero address");
require(premium <= maxAcceptablePremium, "Premium too high");

4. Protect Against Slippage

uint256 received = dex.swap(tokenIn, tokenOut, amountIn);
require(received >= minAmountOut, "Slippage exceeded");

5. Set Appropriate Gas Limits

pool.flashLoan(...).send({ feeLimit: 500_000_000 }); // 500 TRX

Emergency Procedures

Circuit Breaker

Incident Response

Contact