PROOF
The part you can check
Deployment, every owner power, the review that attacked this contract, and the test numbers. All of it generated from the source at a named commit, not typed into a marketing page.
DEPLOYMENT
LAUNCH CAPS
OWNER POWERS // ALL 9, EXHAUSTIVELY
| FUNCTION | SRC | MOVES USER FUNDS |
|---|---|---|
| setFeeBps() | 555 | NO |
| setGraceSurchargeBps() | 563 | NO |
| setHouseToken() | 572 | NO |
| setHouseFeeBps() | 578 | NO |
| setMaxAskPrice() | 587 | NO |
| setMaxOutstandingEth() | 595 | NO |
| setAllowedToken() | 603 | NO |
| setListingsPaused() | 610 | NO |
| withdrawFees() | 620 | NO |
| transferOwnership() | OZ | NO |
| acceptOwnership() | OZ | NO |
| renounceOwnership() | OZ | NO |
That is the complete list. Collateral leaves the vault through exactly three paths, each gated on the caller being that specific party: cancel and reclaim to the borrower, claim to the lender (DealVault.sol:352, DealVault.sol:457). The one owner-callable transfer, withdrawFees, is bounded by a fee counter that is disjoint from user ETH. The contract is immutable: no proxy, no upgrade path, no admin withdrawal, and no rescue or sweep function of any kind.
TESTS
Coverage is on DealVault.sol only. Both slither mediums and every low are reviewed in the contract README; none are unexplained. Numbers generated from the repository at 70f9806.
ADVERSARIAL REVIEW
Before launch the contract was attacked by an independent suite written against it without reading its own tests. It found eight things. One was critical and is fixed. Four are accepted with reasons. Here is the whole list.
- F1CRITICALETH payout return bombFIXED
- F2MEDIUMCap exhaustion griefingFIXED
- F3MEDIUMBlocklisted lender strands collateralACCEPTED
- F4MEDIUMSender-tax / negative rebase strands last exitACCEPTED
- F5LOWOwner changes fee on a LISTED dealACCEPTED
- F6LOWCredit stuck for a no-receive recipientACCEPTED
- F7INFOGas-burning lender, ~3.16M gasACCEPTED
- F8INFOOverflows above 1e73 weiIGNORED
CRITICAL · FIXED
F1: a lender could force every borrower to default
WHAT IT WAS
Paying the lender used Solidity's call, which copies the recipient's return data into memory even when the bytes are thrown away. A lender contract could size that return data to whatever gas it was handed, so the copy cost more than the 1/64 of gas the caller keeps. Reclaiming then ran out of gas at every gas limit tested, from 1M to 1,000,000,000. The attacker waited out the grace window and took the collateral.
WHAT CHANGED
Every ETH payout now goes through _rawSend, a raw CALL with a zero-length output area, so no return data is ever copied. A recipient that reverts, burns its gas or returns garbage is treated identically: the send reports failure and the ETH is parked for that recipient to pull. The regression test proves reclaim succeeds at 300k gas and at every limit above it.
DealVault.sol:679 · ReturnBomb.t.sol
ACCEPTED, NOT FIXED: F3 AND F4 ARE TOKEN-TRUST FAILURES A HOSTILE ERC-20 CAN CAUSE, AND THE ALLOWLIST IS THE MITIGATION. F5 AND F6 ARE BOUNDED AND DOCUMENTED. ALL FOUR ARE WRITTEN UP IN FULL, INCLUDING WHY.
GENERATED FROM contracts/ AT 70f9806 · 8 CONSTANTS · 9 OWNER FUNCTIONS · 8 FINDINGS