Felix Price Feeds audit
A private security review of Felix (CDP stablecoin), conducted solo and completed on 14th March 2025 over 2 days. 0xSimao disclosed 7 findings: 1 medium and 6 informational.
What Felix is
Felix is a CDP stablecoin in the Liquity lineage: collateralised troves mint the dollar token, a stability pool and redistribution absorb liquidations, and an oracle layer built on RedStone price feeds gates every operation that depends on collateral value.
Scope
The solo review concentrated on the oracle layer and the strategy plumbing around it: RedStonePriceFeedBase's behaviour when a feed misbehaves, the shutdown it can trigger, gas forwarding into Curve-routed paths, and the permissionless interest-distribution strategies.
Medium severity findings
Informational findings
- Missing provideToSpOnBehalfOf interface
- In case of success, some leftover funds could still be present in the adapter
- Missing priceFeedDisabled event in RedStonePriceFeedBase
- Gas forwarded by the CurveGaugeDistributor could be limited to further prevent OOG
- The check rewardSelector != ZERO BYTES4 && rewardDestination.isContract() could be improved
- InterestRouterV2::triggerDistribution() may be vulnerable to arbitrage stratregies due to being permissionless
The report