Options protocol audit

DIEMT-2IVX · High · Pending

Fees for a trade’s delta were valued at the asset price, but fees for its vega were not. The vega part of the fee came out negligible, so trades that loaded the AMM with vega paid far less than intended.

Greeks Read the finding DIEMT-2 in the IVX Options Protocol report

H-01Synthetix TLX V2 · High

A redemption pulled margin from the leveraged token’s Synthetix position at a Chainlink price that had not yet caught up with the market. An attacker could size a redemption that passed the margin check at the stale price and left the position liquidatable once the feed updated.

Liquidations Read the finding H-01 in the Synthetix TLX V2 report

H-02Synthetix TLX V2 · High

The decaying redemption fee stored its five-minute duration as 300e18, so elapsed time divided by it always rounded to zero. Every redeemer paid close to the maximum fee, however long they had held.

Fees Read the finding H-02 in the Synthetix TLX V2 report

DIEMT-1IVX · Critical · Pending

The binomial pricer set its time step to the seconds left to expiry divided by 15. In an option’s last 15 seconds the step rounded to zero and pricing reverted, blocking opens, closes and liquidations for every option.

Expiry Read the finding DIEMT-1 in the IVX Options Protocol report

H-07Kairos · High

Signed risk-premium reports were not tied to the base rate they were modeled on. A relayer could hold a still-fresh report until the base rate moved, then trade a pairing the reporters never priced, at the expense of LP backing.

Rate inputs Read the finding H-07 in the Kairos Follow-Up Review report

H-02Kairos · High

LP shares were priced from full mark-to-market swap PnL, but settlement is capped by the collateral each swap actually holds. An LP could withdraw against gains the pool would never collect, leaving the shortfall to the LPs who stayed.

Rate swaps Read the finding H-02 in the Kairos Protocol Review report

H-06Kairos · High

A swap bucket could hold expired and live positions together, and expired swaps were valued as if still running. Forced exits then booked the wrong reserve, which a co-LP could capture.

Maturities Read the finding H-06 in the Kairos Follow-Up Review report

H-03Strata · High

When the senior tranche reported a loss, the code added it to the junior tranche’s old NAV instead of its updated one. The loss was neither taken from seniors nor credited to juniors, against the spec for both.

Tranches Read the finding H-03 in the Strata Tranches report

H-01Synthetix TLX · High

Once market skew passed the price-impact tolerance, every rebalance order the TLX vault committed could be cancelled. An attacker could mint small amounts to trigger orders, cancel each one and collect the keeper reward from the vault’s margin.

Rebalancing Read the finding H-01 in the Synthetix TLX report

H-03Bounce Tech · High

Bridged USDT0 was valued at the spot USDT/USDC price, so a leveraged token’s value jumped in a step when funds moved to HyperCore. With that price moving up to 2% and a 0.3% redemption fee, minting and redeeming at once could extract funds.

Leveraged tokens Read the finding H-03 in the Bounce Tech Leveraged Token Protocol report