Tokemak audit contest

A public audit contest on Sherlock (liquidity provisioning), completed on 17th July 2023. 0xSimao placed #15. 7 of his findings are published: 4 high severity and 3 medium.

What Tokemak is

Tokemak v2 is liquidity infrastructure: autopilot vaults (LMPs) allocate deposits across destination vaults holding Curve and Balancer positions, rebalancing by a solver against a return model, so LPs hold one token while the system chases the most productive placement.

Scope

Tokemak v2: the autopilot vaults and their strategies, destination vaults over Curve and Balancer positions, and the rewarders.

High severity findings

• Immediately start getting rewards belonging to others after staking
• Aura/Convex rewards are stuck after DOS
• Destination Vault rewards are not added to idleIncrease when info.totalAssetsPulled > info.totalAssetsToPull
• Liquidations miss delegate call to swapper

Medium severity findings

• Lost rewards when the supply is 0, which always happens if the rewards are queued before anyone has StakeTracker tokens
• previewRedeem and redeem functions deviate from the ERC4626 specification
• Malicious users could lock in the NAV/Share of the DV to cause the loss of fees

The contest

View the contest page