BMX audit contest

A public audit contest on Sherlock (perpetuals DEX), completed on 2nd September 2025. 0xSimao placed #1. 10 of his findings are published: 5 high severity and 5 medium.

What BMX is

BMX is a DeFi ecosystem built to wean liquidity providers off speculative cycles and temporary incentive programs. Deli Swap is a DEX built on Uniswap v4 hooks where LPs earn from two sources at once: swap fees and the underlying yield their wBLT keeps generating inside the pools.

Scope

The Sherlock contest covered the Deli Swap contracts, 24 files and 3,068 nSLOC: the Uniswap v4 hooks running the pools, the split of swap fees and wBLT yield to liquidity providers, and the voter and distributor machinery around them.

High severity findings

• DoSed Voter::finalize() due to unbounded pending removals lacking a batch argument variable
• Finalize-window vote-changing vulnerability: auto-voters can alter choices post-epoch to manipulate results
• RangePool::adjustToTick() desyncs when nextTick == tick leading to stolen fees
• Reward Token Loss for LPs During NFT Position Transfer
• Voter::finalize() incorrect rewards distribution due to transfering WETH before calling distributor::setTokensPerInterval()

Medium severity findings

• Unconditional lastUpdated advance in RangePool.sync leads to loss of streamed BMX when pool liquidity == 0
• Integer Truncation in Incentive Rate Permanently Locks Unstreamed Rewards
• Users always pay fee on the full swapped amount in the DeliHook, even if the swap is smaller
• DeliHookConstantProduct swapping exactOutput and _feeFromOutput is incorrect
• Attacker can swap wBTC in the DeliHook multiples times to not pay / pay less swap fees

The contest

View the contest page