Verdex Audit #2

These contracts read the Aerodrome Slipstream pool price with a 7-field layout, but Slipstream returns 6. Every price read reverted, so nothing on Base could ever fill. No one had used them and no funds were held.

Corrected and redeployed. Orders, vaults and plans were tested end to end on a fork of Base.

The minimum a trade had to return came from the pool price in the same transaction, so an executor that moved the price first could fill at a bad price. For the agent, a sale could be valued at a crashed price.

Every execution now checks the pool's 30-minute average price and refuses to run if the current price is more than about 2% (200 ticks) away. Sales are valued at the higher of the two prices. What an executor can still do is bounded by that 2% band plus the slippage you set.

Reserves were paid out without checking the market held that cash, and interest rates had no upper limit.

A payout is now capped at the market's own cash, and rates are capped at 20% base plus 300% slope. All 14 markets were recreated with their previous settings.

With some settings, a liquidator who moved the pool price could seize all the collateral and leave part of the debt as a loss for suppliers.

Debt is only written off when the position is underwater at the 30-minute average price, and market settings that allow the problem are now rejected.

Half of every VERDEX buy is burned in the same transaction, as described. The other half was paid by an executor to any list it chose, at once.

A payout list is now published on-chain and can only be paid 48 hours later, exactly as published. The owner can cancel a pending list (and so can delay payouts) but cannot take the funds.

A roll's weight comes from a 30-minute average price move. Holding a pool's price up for those 30 minutes could raise a roll's payout.

The cap is now 2x instead of 4x, so the most such a push can add is far smaller. It can still pay when a mine's reserve is large compared with its pool.

The tip is now paid in proportion to what was actually bought; the rest goes back to the plan's owner.

Markets now require the pool to store enough price history for their averaging window, both when created and when changed.

Every swap in Orders, Vaults, Auto-Invest, the agent and the index router now reverts unless the whole input is used.

• Fixed Mines: missed rolls catch up at most once every 20 hours.
• Fixed Term loans: 0% offers can be taken; each loan is at least 1 USDG unless it takes the whole remainder.
• Fixed Lend: a market wiped out by bad debt can take new supply again; liquidations and borrows that would move zero shares revert; settings changes emit events.
• Fixed Leverage: shorts are capped at 2x in the contract, as longs already were.
• Fixed Index: redemptions pay pro rata when a component runs short, and new shares cannot be issued until it is fully backed again. The router's sells leave nothing behind.
• Fixed Treasury: the USDG leg of its floor uses the better of the current and average price; only listed spenders can be approved; stray tokens can only be sent to the burn address; ownership changes take two steps.
• Fixed Gift: a gift key is scoped to its sender, so copying one cannot block a gift.
• Fixed Vote: closed rounds are weighed at the balances held when they closed.
• Acknowledged Holding any amount of VERDEX waives the Leverage and index fees. This is the product rule across Verdex.
• Acknowledged Anyone can temporarily fill a Lend or Leverage cap with their own funds.
• Acknowledged Changing Lend's reserve share does not settle interest first, so it applies to interest not yet accrued.

• Checked A Mines pool with short price history could have stopped all rolls. All seven pools store 7,200 to 14,400 price points, and the new contract refuses any pool with too few.
• Acknowledged Options: the writer picks the underlying, and a token with transfer restrictions could block exercise.
• Acknowledged Feed: a single poster sets the price. No Verdex contract reads it and no feed is deployed today.
• Acknowledged Per-wallet lists of options, loans and offers are never pruned.

A single key ran every executor, the Mines keeper, the gift relay and the treasury executor, and its storage needed hardening.

Replaced with new keys, one for automation and one for the treasury, held only in our host's secret store and never in uploaded files. The new contracts trust only the new keys, and the old key has no role in them.

It now signs only routes to LI.FI's own contract, with no ETH attached.

The executor skips anything with a tip under 0.01 USDG, runs at most five items per owner and sixty per pass, and caps the gas of every transaction.

A ?buy= link now takes the token's name and decimals from the token list or the quote, never from the link, and warns, showing the address, when a token is not listed.

Only real browser push services are accepted, every send times out after 10 seconds, sign-ups are rate limited, and the push passes cannot overlap.

Approvals are now for the exact amount of each swap, and the app refuses any route that does not go through LI.FI's own contract.

Chart requests are normalised and capped, and the data-provider queue is bounded.

• Fixed API errors no longer include internal details.
• Fixed The static file check uses the full path.
• Fixed Rate limits use the address our host's edge saw, not one the client can write.
• Fixed The quote API rejects tokens it does not know instead of guessing their decimals.
• Mitigated Referrer-Policy, HSTS, Permissions-Policy and a base CSP are set. A full script CSP is not yet, because the app is designed to be embedded by partners.