Security
Who holds a key, what the tests pin, and what nobody has checked.
Who can do what
Three answers, and only one of them is us.
- The ownerKey
Sets the terms inside the bounds below, withdraws the treasury and idle pool cash, can pause new loans, and holds the emergency withdrawal that reaches escrowed collateral. It also owns the beacon, so it can replace the code.
- The underwriterKey
Signs the offers a borrower presents. It cannot move money: the chain re-checks every offer against its own cap, so a stolen signing key cannot lend more than the collateral carries. The owner can rotate it.
- AnyoneNo key
Delivers the tax (flush), moves the price clock (poke), and runs a liquidation step for 0.5% of what it sells. None of these needs us, which is the point: liquidation has to work when we are not there.
On BNB Chain the owner is 0xb24C…860C and the factory is 0xB282…f046.
What the owner cannot do
The settings are the owner's; the bounds on them are the code's.
| Setting | Now | Bound |
|---|---|---|
| The all-in fee | 4% today | never over 20% |
| A loan opens at | 40% of value | never over 60%, and never at or above the liquidation line |
| Liquidation starts at | 80% | between 50% and 95% |
| One step sells | 0.5% of depth | never over 5% |
| With a cooldown of | 5 minutes | never under 1 minute |
| The step's caller keeps | 0.5% | never over 2% |
| The treasury takes | 3% of arrivals | never over 20% |
| The term | 7 days | between 1 day and 90 days |
- A change never moves an open loan: it keeps the fee, the term and the lines it was written with.
- A loan can never open already liquidatable: the code refuses a setting that would allow it.
- None of this bounds the emergency withdrawal. That is the trade.
Every guard, broken on purpose
A check nobody has seen fail is not a check.
Each gate swaps exactly one mistake into the source and requires a named test to fail because of it. 38 of 38 are recorded red on the current source (the record is older than the source shown here), fingerprint 440009fdf9031d22.
- 01
- 02
- 03
- 04
- 05
- 06
- 07
- 08
- 09
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 42 tests offline and 4 against BNB Chain itself, including the liquidation engine on the live PancakeSwap pair.
- Stateful invariants drive the vault through arrivals, loans, repayments, price moves and liquidations, and check the ledgers after every call.
- The fork run is what found the real bug: a router sale pays the token's tax twice, so the vault's own floor was 2% too high and a step reverted on it.
What has not been checked
Written here because it is easier to leave out.
- No external audit. Nobody outside this project has reviewed these contracts. There is no Flap audit and no Flap Guardian: this factory is not registered with them.
- The valuation is conservative by construction, but it has never been tested against a token with unusual tax behaviour, a rebasing supply or a pair somebody seeds with their own liquidity.
- The keeper is ours and can stop. Liquidation does not depend on it (anyone may call a step for the bounty), but nobody is obliged to.
Read the risks before you borrow here.