Flayer audit contest

A public audit contest on Sherlock (NFT liquidity), completed on 2nd September 2024. 0xSimao placed #13. 3 of his findings are published: 2 high severity and 1 medium.

What Flayer is

Flayer is NFT liquidity infrastructure on Uniswap V4: a collection's NFTs deposit into fungible collection tokens whose markets run as V4 hooks, listings and protected listings sell and collateralise individual pieces, and the Moongate bridge carries collections across chains.

Scope

The Flayer protocol: collection tokens and their Uniswap V4 hooks, listings and protected listings, and the Moongate bridge integration.

High severity findings

• The health of a ProtectedListing is incorrectly calculated if the tokenTaken has be changed through ProtectedListings::adjustPosition().
• Lister is overpaying during the cancel of his listing on Listings::cancelListings().

Medium severity findings

• In the unlockProtectedListing() function, the interest that was supposed to be distributed to LP holders was instead burned.

The contest

View the contest page