Security
Reviewed, tested, and plain about what is left.
The contracts went through Arc Studio's security review and Slither before deployment. This is a hackathon build on testnet, not audited software.
Review
Five Medium findings fixed, one High left open by decision.
M1 fixedLiquidity provider (LP) exit before a writedownLP flows pause until markImpaired
M2 fixedFuture-dated net asset value (NAV) could freeze a fundreports over 5 min ahead rejected
M3 fixedShared Chainlink Runtime Environment (CRE) forwarderoptional workflow owner and id pinning
M4 fixedSettlement on a bad NAVsettle reverts, retry later
M5 fixedAllowlist skipped on depositAndSellboth entry paths enforce it
H1 openLP gain sniping at settlementaccepted for testnet, see below
63 Foundry tests pass. Full report and proof of concept in docs/studio in the repository.
Open finding
Late deposits can take part of a settlement gain.
Claims are held at cost and the whole gain lands when settle runs. Capital that deposits just before and leaves right after takes a share of a gain that earlier LPs funded. The fix before real money is to accrue claim value linearly to the payout date inside totalAssets.
Trust
What you are trusting today.
Ops walletowns every contractcan list funds and set terms
Oracle forwarderops wallet or CREcan write NAV and status
Keeperanyonemust call settle at maturity
Stand-insfund, issuer, status APIreal ones are permissioned
Report an issue
Found something? Tell us.
Open an issue in the repository. Never post private keys or seed phrases.