Spark Spell 2026-01-29 Security Review

Summary

Overall, we consider the spell to be ready for deployment and safe.

[Gnosis] SparkLend - Deprecate Market Phase 1

  • Correctly freeze all assets
  • Correctly increase reserve factor to 50%
  • Test passed: SparkEthereum_20260129_SparklendTests.test_GNOSIS_sparkLend_deprecateMarket()

Overall status: safe

[Ethereum] SparkLend - Deprecate tBTC Phase 1

  • Correct token used
  • Correctly freeze reserve and increase reserve factor to 99%
  • Test passed: SparkEthereum_20260129_SparklendTests.test_ETHEREUM_sparkLend_deprecateTBTC()

Overall status: safe

[Ethereum] SparkLend - Deprecate ezETH Phase 1

  • Correct token used
  • Correctly freeze reserve
  • Test passed: SparkEthereum_20260129_SparklendTests.test_ETHEREUM_sparkLend_deprecateEZETH()

Overall status: safe

[Ethereum] SparkLend - Deprecate rsETH Phase 1

  • Correctly token used
  • Correctly freeze reserve
  • Test passed: SparkEthereum_20260129_SparklendTests.test_ETHEREUM_sparkLend_deprecateRSETH()

[Ethereum] Spark Liquidity Layer - Upgrade ALM Controller to v1.9.0

Prev version: 0xE52d643B27601D4d2BAB2052f30cf936ed413cec Current version: 0xc9ff605003A1b389980f650e1aEFA1ef25C8eE32

Code

MainnetController

AaveLib:

CCTPLib:

CurveLib:

ERC4626Lib:

PSMLib:

UniswapV4Lib:

Upgrade - Migration from v1.8.0

Comparison with controller v1.8.0 upgrade spell events: https://etherscan.io/tx/0x5ddce96bd09c157c502cd8a33e64a8cf7bff891324ea3460d76b0f7925924aff

MaxSlippage in v1.8.0:

  • CURVE_SUSDSUSDT: 0x00836fe54625be242bcfa286207795405ca4fd10 - 0.9975e18 -> Migrated to v1.9.0

  • CURVE_PYUSDUSDC: 0x383E6b4437b59fff47B619CBA855CA29342A8559 - 0.9990e18 -> Migrated to v1.9.0

  • CURVE_USDCUSDT: 0x4f493B7dE8aAC7d55F71853688b1F7C8F0243C85 - 0.9985e18 -> Migrated to v1.9.0

  • CURVE_PYUSDUSDS: 0xA632D59b9B804a956BfaA9b48Af3A1b74808FC1f - 0.998e18 -> Migrated to v1.9.0

  • ATOKEN_CORE_USDC: 0x98C23E9d8f34FEFb1B7BD6a91B7FF122F4e16F5c - 0.99999e18 -> Migrated to v1.9.0

  • ATOKEN_CORE_USDE: 0x4F5923Fc5FD4a93352581b38B7cD26943012DECF - 0.99999e18 -> Migrated to v1.9.0

  • ATOKEN_CORE_USDS: 0x32a6268f9Ba3642Dda7892aDd74f1D34469A4259 - 0.99999e18 -> Migrated to v1.9.0

  • ATOKEN_CORE_USDT: 0x23878914EFE38d27C4D67Ab83ed1b93A74D4086a - 0.99999e18 -> Migrated to v1.9.0

  • ATOKEN_PRIME_USDS: 0x09AA30b182488f769a9824F15E6Ce58591Da4781 - 0.99999e18 -> Migrated to v1.9.0

  • DAI_SPTOKEN: 0x4DEDf26112B3Ec8eC46e7E31EA5e123490B05B8B - 0.99999e18 -> Migrated to v1.9.0

  • USDC_SPTOKEN: 0x377C3bd93f2a2984E1E7bE6A5C22c525eD4A4815 - 0.99999e18 -> Migrated to v1.9.0

  • USDS_SPTOKEN: 0xC02aB1A5eaA8d1B114EF786D9bde108cD4364359 - 0.99999e18 -> Migrated to v1.9.0

  • USDT_SPTOKEN: 0xe7dF13b8e3d6740fe17CBE928C7334243d86c92f - 0.99999e18 -> Migrated to v1.9.0

  • PYUSD_SPTOKEN: 0x779224df1c756b4EDD899854F32a53E8c2B2ce5d - 0.99999e18 -> Migrated to v1.9.0

  • WETH_SPTOKEN: 0x59cD1C87501baa753d0B5B5Ab5D8416A45cD71DB - 0.99999e18 -> Migrated to v1.9.0

  • CURVE_WEETHWETHNG: 0xDB74dfDD3BB46bE8Ce6C33dC9D82777BCFc3dEd5 - 0.9975e18 -> Migrated to v1.9.0

MaxExchangeRate in v1.8.0:

  • MORPHO_VAULT_USDC_BC: 0x56A76b428244a50513ec81e225a293d128fd581D - 1e25 -> Set to 1/10 in v1.9.0

  • MORPHO_VAULT_DAI_1: 0x73e65DBD630f90604062f6E02fAb9138e713edD9 - 1e37 -> Set to 1/10 in v1.9.0

  • MORPHO_VAULT_USDS: 0xe41a0583334f0dc4E023Acd0bFef3667F6FE0597 - 1e37 -> Set to 1/10 in v1.9.0

  • SUSDS: 0xa3931d71877C0E7a3148CB7Eb4463524FEc27fbD - 1e37 -> Set to 1/10 in v1.9.0

  • FLUID_SUSDS: 0x2BBE31d63E6813E3AC858C04dae43FB2a72B0D11 - 1e37 -> Set to 1/10 in v1.9.0

  • SUSDE: 0x9D39A5DE30e57443BfF2A8307A4256c8797A3497 - 1e37 -> Set to 1/10 in v1.9.0

  • SYRUP_USDC: 0x80ac24aA929eaF5013f6436cdA2a7ba190f5Cc0b - 1e37 -> Set to 1/10 in v1.9.0

  • SYRUP_USDT: 0x356B8d89c1e1239Cbbb9dE4815c39A1474d5BA7D - 1e37 -> Set to 1/10 in v1.9.0

  • ARKIS_VAULT: 0x38464507E02c983F20428a6E8566693fE9e422a9 - 1e37 -> Set to 1/10 in v1.9.0

MintRecipients in v.1.8.0:

  • Base.ALM_PROXY: 0x2917956eFF0B5eaF030abDB4EF4296DF775009cA -> Migrated to v1.9.0
  • Arbitrum.ALM_PROXY: 0x92afd6F2385a90e44da3a8B60fe36f6cBe1D8709 -> Migrated to v1.9.0
  • Optimism.ALM_PROXY: 0x876664f0c9Ff24D1aa355Ce9f1680AE1A5bf36fB -> Migrated to v1.9.0
  • Unichain.ALM_PROXY: 0x345E368fcCd62266B3f5F37C9a131FD1c39f5869 -> Migrated to v1.9.0
  • Avalanche.ALM_PROXY: 0xecE6B0E8a54c2f44e066fBb9234e7157B15b7FeC -> Migrated to v1.9.0

layerZeroRecipients list is empty in v1.8.0 -> Migrated to v1.9.0

OTCRechargeRate/OTCBuffer/OTCWhitelistedAsset are empty in v1.8.0 -> Migrated to v.1.9.0

Tests passed:

  • SparkEthereum_20260129_SLLTests.test_ETHEREUM_controllerUpgrade()
  • SparkEthereum_20260129_SLLTests.test_ETHEREUM_controllerUpgradeEvents()

Overall status: safe

[Ethereum] Spark Liquidity Layer - Onboard Uniswap v4 PYUSD/USDS Pool

PYUSD_USDS_POOL_ID: 0xe63e32b2ae40601662f760d6bf5d771057324fbd97784fe1d3717069f7b75d45

PYUSD/USDS Pool configuration:

  • tickLower: 276_314 - matches with docs
  • tickUpper: 276_334 - matches with docs
  • maxTickSpacing: 10 - matches with docs
  • maxSlippage: 0.999e18 - matches with docs. It has been verified that the parameter corresponds to a value of 0.1%
  • depositMax: 10_000_000e18 - matches with docs. Checked that UniswapV4Lib
  • depositSlope: 100_000_000e18 / day - matches with docs
  • withdrawMax: 50_000_000e18 - matches with docs
  • withdrawSlope: 200_000_000e18 / day - matches with docs
  • swapMax: 5_000_000e18 - matches with docs
  • swapSlope: 50_000_000e18 / day - matches with docs

Checked that price goes -0.1% at 276_314 tick and goes +0.1% at 276_334 tick. It has been verified that the maxSlippage parameter corresponds to a value of 0.1%. Checked that UniswapV4Lib take into account tokens decimals when interacting with limits. Test passed: SparkEthereum_20260129_SLLTests.test_ETHEREUM_sparkLiquidityLayer_onboardUniswapV4PYUSDUSDS()

Overall status: safe

[Ethereum] Spark Liquidity Layer - Onboard Uniswap v4 USDT/USDS Pool

USDT_USDS_POOL_ID: 0x3b1b1f2e775a6db1664f8e7d59ad568605ea2406312c11aef03146c0cf89d5b9

USDT/USDS Pool configuration:

  • tickLower: 276_304 - matches with docs
  • tickUpper: 276_344 - matches with docs
  • maxTickSpacing: 10 - matches with docs
  • maxSlippage: 0.998e18 - matches with docs
  • depositMax: 5_000_000e18 - matches with docs
  • depositSlope: 50_000_000e18 / day - matches with docs
  • withdrawMax: 50_000_000e18 - matches with docs
  • withdrawSlope: 200_000_000e18 / day - matches with docs
  • swapMax: 5_000_000e18 - matches with docs
  • swapSlope: 50_000_000e18 / day - matches with docs

Checked that price goes -0.2% at 276_304 tick and goes +0.2% at 276_344 tick. It has been verified that the maxSlippage parameter corresponds to a value of 0.2%. Checked that UniswapV4Lib take into account tokens decimals when interacting with limits. Test passed: SparkEthereum_20260129_SLLTests.test_ETHEREUM_sparkLiquidityLayer_onboardUniswapV4USDTUSDS()

Overall status: safe

[Ethereum] Spark Savings - Increase spUSDT Supply Cap

  • Correct token used: spUSDT
  • Correct supply cap provided: 2 billion
  • Test passed: SparkEthereum_20260129_SLLTests.test_ETHEREUM_sparkSavingsV2_increaseVaultDepositCaps()

Overall status: safe

[Ethereum] Spark Treasury - Spark Foundation Grant for February 2026 (Exec)

  • Correct addresses provided: 0x92e4629a4510AF5819d7D1601464C233599fF5ec
  • Correct token used: USDS
  • Correct amounts provided: 1,100,000
  • Test passed: SparkEthereum_20260129_SpellTests.test_ETHEREUM_sparkTreasury_foundationGrant()

Overall status: safe