INIT Capital audit
A private security review of INIT Capital (money market), conducted with Code4rena and completed on 15th December 2023. 0xSimao disclosed 5 findings: 1 high severity and 4 medium.
What INIT Capital is
INIT Capital is a position-based money market: lending positions are first-class objects that strategies and integrations can hold, borrow against and compose, with liquidity hooks letting other protocols plug leverage directly into the market.
Scope
The INIT Capital core money market, reviewed in a Code4rena invitational: positions, the pool lending flows and the liquidity hooks.
High severity findings
Medium severity findings
- repay(), liquidate() and liquidateWLp() receive shares as argument, which may revert if from approval to tx settled blocks have passed
- Decimals of LendingPool don't take into account the offset introduced by VIRTUAL_SHARES
- If wLP is blacklisted, then user will not be able to withdraw it
- API3 oracle timestamp can be set to future timestamp and block API3 Oracle usage to make code revert in underflow
The report