INIT Capital audit

A private security review of INIT Capital (money market), conducted with Code4rena and completed on 15th December 2023. 0xSimao disclosed 5 findings: 1 high severity and 4 medium.

High severity findings

• Liquidations can be prevented by frontrunning and liquidating 1 debt (or more) due to wrong assumption in POS_MANAGER

Medium severity findings

• repay(), liquidate() and liquidateWLp() receive shares as argument, which may revert if from approval to tx settled blocks have passed
• Decimals of LendingPool don't take into account the offset introduced by VIRTUAL_SHARES
• If wLP is blacklisted, then user will not be able to withdraw it
• API3 oracle timestamp can be set to future timestamp and block API3 Oracle usage to make code revert in underflow

The report

Read the report