Lending protocol audit

C-01Callisto · Critical

A liquidated borrower’s debt was divided by the interest index before being spread to other borrowers. After a year at 50% APR, about one of three debt tokens vanished.

Index math Read the finding C-01 in the Callisto report

ML-1Ambit · High

Each collateral had its own LTV, so a partial liquidation could cut borrowing power faster than debt. In the report’s example, a 0.80 health score fell to 0.60.

Liquidations Read the finding ML-1 in the Ambit report

H-02Impermax V3 · High

The oracle averaged TWAPs across every Uniswap pool for a pair. Deploying a new fee tier with no history made it revert, blocking underwater checks and bad-debt restructuring.

Oracles Read the finding H-02 in the Impermax V3 report

C-03Sentiment V2 · Critical

Borrows were not capped at a pool’s own liquidity, so one pool could lend out other pools’ deposits in the shared contract. Lenders elsewhere could no longer redeem.

Isolated markets Read the finding C-03 in the Sentiment V2 report

C-01Impermax V3 · Critical

A borrow callback ran before the debt was recorded. Inside it, the borrower redeemed their LP position NFT, keeping both the loan and the collateral.

LP collateral Read the finding C-01 in the Impermax V3 report

C-01Vanir · Critical

A liquidation contract on a SparkLend-based platform took its lending pool and swap router addresses from the caller. An attacker could pass their own and pull any user’s approved tokens.

Flash-loan helpers Read the finding C-01 in the Vanir report

M-033Jane · Medium

Until a loss was reported, the credit cap kept its old, higher value. A second borrower could draw the extra liquidity first, pushing a later default past junior capital to senior holders.

Credit Read the finding M-03 in the 3Jane LCC report

H-01Tenor Morpho · High

Overdue loan renewals measured the new term from the expired maturity, not from execution. Sixty days overdue into a 30-day term, a 10% rate ceiling became roughly 30%.

Term loans Read the finding H-01 in the Tenor Morpho Integration report

ITVF-1Dolomite · Critical

A borrower could keep requeuing a GM token withdrawal with an impossible minimum output. With the whole balance pending, liquidators could seize nothing.

Yield-bearing collateral Read the finding ITVF-1 in the Dolomite GMX V2 Module report

C-01Magnify Cash · Critical

A lender could delete the loan config an active ERC1155 loan relied on, so repayments reverted. Once the loan expired, the lender restored it and claimed the NFT.

NFT lending Read the finding C-01 in the Magnify Cash NFT Lending Protocol report

$20MSonne Finance

A Compound v2 fork hit by a known donation attack. Anyone could activate its new market once the timelock expired, and the attacker did it in the attack transaction.

May 2024 Our coverage of the Sonne Finance incident

$9.05MBonzo

An oracle verifier accepted a SAUCE price without a valid signature, and about $9.05 million of principal was extracted.

Jul 2026 Our coverage of the Bonzo incident