# INIT Capital audit Code4rena · Money market · 15th December 2023 A private security review of INIT Capital (money market), conducted with Code4rena and completed on 15th December 2023. 0xSimao disclosed 5 findings: 1 high severity and 4 medium. ## What INIT Capital is INIT Capital is a position-based money market: lending positions are first-class objects that strategies and integrations can hold, borrow against and compose, with liquidity hooks letting other protocols plug leverage directly into the market. ## Scope The INIT Capital core money market, reviewed in a Code4rena invitational: positions, the pool lending flows and the liquidity hooks. ## High severity findings - [Liquidations can be prevented by frontrunning and liquidating 1 debt (or more) due to wrong assumption in POS_MANAGER](https://0xsimao.com/findings/init-capital-ii-liquidations-frontrunning-debt-assumption) ## Medium severity findings - [repay(), liquidate() and liquidateWLp() receive shares as argument, which may revert if from approval to tx settled blocks have passed](https://0xsimao.com/findings/init-capital-ii-repay-liquidate-shares-approval) - [Decimals of LendingPool don't take into account the offset introduced by VIRTUAL_SHARES](https://0xsimao.com/findings/init-capital-ii-decimals-introduced-virtual-shares) - [If wLP is blacklisted, then user will not be able to withdraw it](https://0xsimao.com/findings/init-capital-ii-blacklisted-user-able-withdraw) - [API3 oracle timestamp can be set to future timestamp and block API3 Oracle usage to make code revert in underflow](https://0xsimao.com/findings/init-capital-ii-oracle-timestamp-revert-underflow) ## The report [Read the report](https://github.com/0xsimao/audits/blob/main/Code4rena/private-audits/2023-12-15-init-capital-ii.md)