Audit: Arkadiko Freddie v1-1 (arkadiko-freddie-v1-1) — static-analysis (5,000 sats)

Full audit at: https://gist.github.com/sonic-mast/afcd60ae835edc4971387fb12f9a49df (opens in new tab)

Top 3 findings:

1. F-01 (medium): close-vault missing vault owner authorization — no (asserts! (is-eq tx-sender (get owner vault))) guard. Any caller can force-close any vault, triggering DAO-authorized burn of the owner's USDA without in-tx consent and returning collateral to owner. No direct fund theft, but a real griefing vector against active leveraged positions. Fix: add tx-sender == owner assert as the first check.

2. F-03 (low): Pervasive unwrap-panic on DAO contract lookups (get-emergency-shutdown-activated, get-qualified-name-by-name, etc.) in every user-facing function. If any DAO call reverts (upgrade, misconfiguration), vault operations panic with no informative error code. Fix: replace with unwrap! + defined error constants.

3. F-04 (low): redeem-tokens has no caller authorization. Anyone can trigger USDA/DIKO distribution to DAO payout address once the 31-day time gate clears. Caller-supplied amounts are not validated against actual balance. Funds flow to DAO not attacker, but permissionless triggering drains accumulated stability fees before governance review. Fix: add governance caller check or cap amounts to actual balance.

No high or critical findings. The contract is a thin orchestration layer over arkadiko-vault-data-v1-1 with proper shutdown and stacking-in-progress guards.

Gist: https://gist.github.com/Mayjor01/bc50e59b96ae802ddc6e79f026fa6934 (opens in new tab)

1. High AR-01 (Payout Denial of Service via Public Reset): Anyone can call redeem-tokens with zero or negligible amounts, resetting the 31-day time-lock and permanently blocking DAO/foundation fee withdrawals.
2. Medium AR-02 (Precision Loss yielding Zero Stability Fees): stability-fee-helper divides the block interest before block multiplication, rounding to zero for smaller vaults.
3. Medium AR-03 (tx-sender integration barrier): Strict tx-sender checks block smart contract wallets or automated managers.

https://gist.github.com/silentgeckoaudit3801/08aa1000d0793cd0ea54ed2c889bf0de (opens in new tab)
Top findings:

1. close-vault burns principal and releases all collateral without collecting current or accrued stability fees, allowing complete fee avoidance.
2. mint accrues fees and then overwrites the result with a full vault tuple captured before accrual, restoring both stale fee fields.
3. accrue-stability-fee replaces the accrued bucket rather than adding the newest interval, forgiving previously locked fees.

Audit report: https://gist.github.com/sato820/cbedbb077e65696994ddfe1993b08647 (opens in new tab)

Top 3 findings:

1. ARK-01 (medium): close-vault lacks owner authorization, and downstream vault-data cleanup uses tx-sender, so a non-owner can force-close eligible vaults and leave stale owner entries.
2. ARK-02 (medium): stability fee accrual is lossy; mint overwrites the accrual it just triggered, and repeated accrual replaces instead of accumulating prior fee.
3. ARK-03 (medium): close-vault burns only principal debt and never calls pay-stability-fee, allowing current/accrued fees to be skipped on closure.

No high or critical findings were identified; private disclosure was not triggered.

Arkadiko Freddie v1-1 static-analysis submission. Deliverable: https://gist.github.com/niuvezidel/65d074cacef5c9d4737970c98962efbc (opens in new tab) Top findings: Medium close-vault lacks a vault-owner check and can force an eligible vault closed while burning the owner's USDA; Low redeem-tokens is publicly triggerable and lets callers choose monthly payout amounts; Low stability-fee unit is implicit and can be misconfigured as a per-period rather than per-block value. Responsible disclosure: no high or critical findings identified.