# BMX audit contest Sherlock · Perpetuals DEX · 2nd September 2025 · #1 A public audit contest on Sherlock (perpetuals DEX), completed on 2nd September 2025. 0xSimao placed #1. 10 of his findings are published: 5 high severity and 5 medium. ## What BMX is BMX is a DeFi ecosystem built to wean liquidity providers off speculative cycles and temporary incentive programs. Deli Swap is a DEX built on Uniswap v4 hooks where LPs earn from two sources at once: swap fees and the underlying yield their wBLT keeps generating inside the pools. ## Scope The Sherlock contest covered the Deli Swap contracts, 24 files and 3,068 nSLOC: the Uniswap v4 hooks running the pools, the split of swap fees and wBLT yield to liquidity providers, and the voter and distributor machinery around them. ## High severity findings - [DoSed `Voter::finalize()` due to unbounded pending removals lacking a batch argument variable](https://0xsimao.com/findings/bmx-voter-unbounded-removals-lacking) - [Finalize-window vote-changing vulnerability: auto-voters can alter choices post-epoch to manipulate results](https://0xsimao.com/findings/bmx-vote-vulnerability-choices-epoch) - [`RangePool::adjustToTick()` desyncs when `nextTick == tick` leading to stolen fees](https://0xsimao.com/findings/bmx-adjust-desyncs-stolen-fees) - [Reward Token Loss for LPs During NFT Position Transfer](https://0xsimao.com/findings/bmx-reward-nft-position-transfer) - [`Voter::finalize()` incorrect rewards distribution due to transfering WETH before calling `distributor::setTokensPerInterval()`](https://0xsimao.com/findings/bmx-voter-rewards-transfering-weth) ## Medium severity findings - [Unconditional lastUpdated advance in RangePool.sync leads to loss of streamed BMX when pool liquidity == 0](https://0xsimao.com/findings/bmx-unconditional-range-streamed-bmx) - [Integer Truncation in Incentive Rate Permanently Locks Unstreamed Rewards](https://0xsimao.com/findings/bmx-truncation-permanently-unstreamed-rewards) - [Users always pay fee on the full swapped amount in the `DeliHook`, even if the swap is smaller](https://0xsimao.com/findings/bmx-fee-full-swapped-hook) - [`DeliHookConstantProduct` swapping `exactOutput` and `_feeFromOutput` is incorrect](https://0xsimao.com/findings/bmx-hook-product-output-fee) - [Attacker can swap wBTC in the DeliHook multiples times to not pay / pay less swap fees](https://0xsimao.com/findings/bmx-btc-hook-multiples-fees) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/1154)