# Tokemak audit contest Sherlock · Liquidity provisioning · 17th July 2023 · #15 A public audit contest on Sherlock (liquidity provisioning), completed on 17th July 2023. 0xSimao placed #15. 7 of his findings are published: 4 high severity and 3 medium. ## What Tokemak is Tokemak v2 is liquidity infrastructure: autopilot vaults (LMPs) allocate deposits across destination vaults holding Curve and Balancer positions, rebalancing by a solver against a return model, so LPs hold one token while the system chases the most productive placement. ## Scope Tokemak v2: the autopilot vaults and their strategies, destination vaults over Curve and Balancer positions, and the rewarders. ## High severity findings - [Immediately start getting rewards belonging to others after staking](https://0xsimao.com/findings/tokemak-rewards-belonging-others-staking) - [Aura/Convex rewards are stuck after DOS](https://0xsimao.com/findings/tokemak-convex-rewards-stuck-dos) - [Destination Vault rewards are not added to idleIncrease when info.totalAssetsPulled > info.totalAssetsToPull](https://0xsimao.com/findings/tokemak-rewards-info-pulled-pull) - [Liquidations miss delegate call to swapper](https://0xsimao.com/findings/tokemak-liquidations-miss-delegate-swapper) ## Medium severity findings - [Lost rewards when the supply is `0`, which always happens if the rewards are queued before anyone has `StakeTracker` tokens](https://0xsimao.com/findings/tokemak-rewards-happens-stake-tracker) - [`previewRedeem` and `redeem` functions deviate from the ERC4626 specification](https://0xsimao.com/findings/tokemak-redeem-deviate-erc4626-specification) - [Malicious users could lock in the NAV/Share of the DV to cause the loss of fees](https://0xsimao.com/findings/tokemak-lock-nav-share-fees) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/101)