# Felix Price Feeds audit 0xSimao · CDP stablecoin · 14th March 2025 A private security review of Felix (CDP stablecoin), conducted solo and completed on 14th March 2025 over 2 days. 0xSimao disclosed 7 findings: 1 medium and 6 informational. ## What Felix is Felix is a CDP stablecoin in the Liquity lineage: collateralised troves mint the dollar token, a stability pool and redistribution absorb liquidations, and an oracle layer built on RedStone price feeds gates every operation that depends on collateral value. ## Scope The solo review concentrated on the oracle layer and the strategy plumbing around it: RedStonePriceFeedBase's behaviour when a feed misbehaves, the shutdown it can trigger, gas forwarding into Curve-routed paths, and the permissionless interest-distribution strategies. ## Medium severity findings - [Attacker can trigger temporary shutdown due to RedStonePriceFeedBase missing gas check](https://0xsimao.com/findings/felix-temporary-shutdown-price-gas) ## Informational findings - [Missing provideToSpOnBehalfOf interface](https://0xsimao.com/findings/felix-missing-provide-behalf-interface) - [In case of success, some leftover funds could still be present in the adapter](https://0xsimao.com/findings/felix-success-leftover-present-adapter) - [Missing priceFeedDisabled event in RedStonePriceFeedBase](https://0xsimao.com/findings/felix-price-disabled-red-stone) - [Gas forwarded by the CurveGaugeDistributor could be limited to further prevent OOG](https://0xsimao.com/findings/felix-gas-forwarded-curve-limited) - [The check rewardSelector != ZERO BYTES4 && rewardDestination.isContract() could be improved](https://0xsimao.com/findings/felix-reward-zero-bytes4-improved) - [InterestRouterV2::triggerDistribution() may be vulnerable to arbitrage stratregies due to being permissionless](https://0xsimao.com/findings/felix-interest-distribution-stratregies-permissionless) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-03-14-felix.pdf)