# Cork Protocol audit contest Sherlock · Derivatives · 29th August 2024 · #1 A public audit contest on Sherlock (derivatives), completed on 29th August 2024. 0xSimao placed #1. 15 of his findings are published: 10 high severity and 5 medium. ## What Cork Protocol is Cork prices, hedges and trades depeg risk: Depeg Swaps pair a pegged asset (a stablecoin or liquid staking token) with cover against its peg breaking, a peg stability module issues and redeems the pair, and vaults write that cover to earn the premium. ## Scope The core contracts ahead of mainnet: the peg stability module, the Depeg Swap pair and the cover-writing vaults. ## High severity findings - [Lack of slippage protection leads to loss of protocol funds](https://0xsimao.com/findings/cork-protocol-lack-slippage-protection-protocol) - [Users redeeming early will withdraw `Ra` without decreasing the amount locked, which will lead to stolen funds when withdrawing after expiry](https://0xsimao.com/findings/cork-protocol-redeeming-withdraw-locked-stolen) - [`VaultPoolLib::reserve()` will store the `Pa` not attributed to user withdrawals incorrectly and leave in untracked once it expires again](https://0xsimao.com/findings/cork-protocol-attributed-withdrawals-untracked-expires) - [FlashSwapRouter::emptyReserve() and FlashSwapROuter::emptyReservePartial() functions return incorrect values](https://0xsimao.com/findings/cork-protocol-flash-empty-outer-partial) - [Incorrect redeemAmount Is Accounted Due To Not Accounting For The Exchange Rate](https://0xsimao.com/findings/cork-protocol-redeem-accounted-accounting-exchange) - [Incoming Redemption Assets not being tracked when repurchase is called](https://0xsimao.com/findings/cork-protocol-incoming-redemption-tracked-repurchase) - [Users will steal excess funds from the Vault due to `VaultPoolLib::redeem()` not always decreasing `self.withdrawalPool.raBalance` and `self.withdrawalPool.paBalance`](https://0xsimao.com/findings/cork-protocol-steal-excess-redeem-withdrawal) - [Wrong accounting of locked RA when repurchasing DS+PA with RA](https://0xsimao.com/findings/cork-protocol-wrong-accounting-locked-repurchasing) - [Admin new issuance or user calling `Vault::redeemExpiredLv()` after `Psm::redeemWithCt()` will lead to stuck funds when trying to withdraw](https://0xsimao.com/findings/cork-protocol-issuance-redeem-stuck-withdraw) - [Attackers will steal the reserve from the `Vault` by receiving `ra` in `FlashSwapRouter::__swapDsforRa()`](https://0xsimao.com/findings/cork-protocol-steal-receiving-flash-dsfor) ## Medium severity findings - [Admin will not be able to only pause deposits in the `Vault` due to incorrect check leading to DoSed withdrawals](https://0xsimao.com/findings/cork-protocol-able-pause-deposits-withdrawals) - [Admin will not be able to upgrade the smart contracts, breaking core functionality and rendering the upgradeable contracts useless](https://0xsimao.com/findings/cork-protocol-upgrade-functionality-rendering-upgradeable) - [Withdrawing all `lv` before expiry will lead to lost funds in the Vault](https://0xsimao.com/findings/cork-protocol-withdrawing-expiry-lost-funds) - [Rebasing tokens are not supported contrary to the readme and will lead to loss of funds](https://0xsimao.com/findings/cork-protocol-rebasing-supported-contrary-readme) - [Providing liquidity to the AMM does not check the return value of actually provided tokens leading to locked funds.](https://0xsimao.com/findings/cork-protocol-providing-actually-provided-locked) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/506)