Ojo Mellow Price Feed audit

A private security review of Ojo Network (oracles), conducted with Three Sigma and completed on 16th October 2024 over 2 days. 0xSimao disclosed 2 findings: 1 low and 1 informational.

What Ojo is

Ojo builds oracle infrastructure, including exchange-rate feeds for liquid restaking tokens with a Morpho-compatible interface. The Mellow feed prices LRTs curated by Mellow vaults, and since those vaults hold several asset types the rate leans on the underlying TVL rather than a one-to-one peg.

Scope

A two-day review of the Mellow feed: MellowPriceFeed and the CloneFactory that stamps out instances, with attention on how a multi-currency vault's TVL becomes a single LRT exchange rate.

Low severity findings

• Hardcoded 1e18 ratio calculation regardless of decimals

Informational findings

• The number of underlying tokens may be modified in the Vault leading to inconsistent exchange rate

The report

Download report (PDF)