Immunefi Audit CompetitionsFirelight Sep.2026 | Audit Competition
Reports by Severity
High
- 88214 - [SC - High] period p 1 cover capacity is computed from collateral a pending period p claim will consume
- 88231 - [SC - High] rescuing a pending withdrawal permanently poisons that bucket
- 88237 - [SC - High] previous period payouts do not reduce current period cover capacity allowing undercollateralized cover to be sold
- 88244 - [SC - High] stale vault snapshot in computeavailablecapacity lets the allocator underwrite cover against collateral an incident payout already spent breaching the enforced solvency floor pro
- 88254 - [SC - High] rescuewithdrawfromblocklisted permanently poisons the period account claim flag causing unrecoverable freezing of any later withdrawal the account makes into the same still
- 88270 - [SC - High] rescuewithdrawfromblocklisted permanently marks period from as claimed bricking future withdrawals for that period and stranding the funds in pendingwithdrawassets
- 88279 - [SC - High] stale period start collateral accounting lets prior period payouts leave newly settled cover fully unbacked
- 88281 - [SC - High] coverorderallocator reuses collateral still backing previous period claims leaving new cover insolvent
- 88286 - [SC - High] requestwithdraw can reuse a withdrawal bucket already closed by rescue permanently freezing fresh user funds
- 88287 - [SC - High] incorrect period boundary checkpoint accounting in firelightvault withdraw lets stakers evade incident slashing and causes protocol insolvency
- 88308 - [SC - High] totalassetsat resolves a period s opening assets inclusively so a withdrawal in the boundary second redefines the ceiling on every claim against that period
- 88321 - [SC - High] stale period start collateral snapshot lets the allocator sell cover against assets already paid out as claims
- 88338 - [SC - High] Stale vault capacity lets Firelight sell cover against collateral owed to prior claims
- 88343 - [SC - High] a payout after the matcher s capacity read lets stale collateral back new cover and creates an unpaid claim
- 88345 - [SC - High] inclusive period boundary checkpoint lets a staker underfund valid claims
- 88353 - [SC - High] a vault exit mined in the first second of a period writes that period s own exposure snapshot permanently short paying an approved cover claim
- 88395 - [SC - High] claim state poisoning in blocklist rescue permanently freezes a later withdrawal
- 88400 - [SC - High] stale period start capacity checkpoint lets commitments ignore previous period payouts and settle fully unbacked cover
- 88410 - [SC - High] rescue terminalizes a still open withdrawal bucket and permanently freezes post unblock principal
- 88411 - [SC - High] unresolved previous period liabilities are reused to underwrite new cover causing a valid claim to receive zero payout
- 88420 - [SC - High] rescuewithdrawfromblocklisted sets the same flag claimwithdraw reads as already claimed and never clears it permanently freezing any later withdrawal the account makes into t
- 88425 - [SC - High] rescue marks an open withdrawal bucket claimed and permanently freezes later post unblock principal
- 88473 - [SC - High] mutable period start checkpoint causes protocol insolvency by underpaying approved cover claims
- 89272 - [SC - High] stale rescue marker permanently freezes a later withdrawal
- 88479 - [SC - High] rescue flags a still open withdrawal bucket permanently freezing the victim s later withdrawals for that period
- 89281 - [SC - High] anyone can permanently destroy any staker s entire balance for 0 000001 fxrp
- 88489 - [SC - High] stale iswithdrawclaimed flag left by a rescue lets a later same period re withdrawal burn a user s shares into a slot no code path can honor permanent freezing of funds
- 88525 - [SC - High] missing upper bound in addperiodconfiguration leads to permanent freezing of withdrawals
- 88534 - [SC - High] checkpoint accounting desync in the payout function leads to protocol insolvency a withdrawal at the exact period start collapses the exposure cap
- 89303 - [SC - High] rescuewithdrawfromblocklisted marks a still open withdrawal bucket as claimed leading to permanent freezing of funds
- 89315 - [SC - High] Boundary-timestamp withdrawal corrupts the period payout cap, allowing a shareholder to evade slashing and permanently underpay an approved claim
- 88553 - [SC - High] coverorderallocator uses stale collateral after payouts
- 89319 - [SC - High] exact period boundary withdrawal is included in the period start exposure lookup and permanently underpays the payout receiver
- 88555 - [SC - High] a depositor withdrawing in the exact period boundary block underpays an approved incident claim by their own withdrawal while the vault still holds the money and counts it as payable
- 88565 - [SC - High] capacity uses a period start snapshot a payout cannot lower so cover is sold against collateral already paid out
- 89373 - [SC - High] delayed previous period claims can leave current cover without collateral
- 89401 - [SC - High] withdrawal requested at the exact period start second lowers the payout cap but stays payable so valid claims are underpaid
- 88570 - [SC - High] period boundary checkpoint overwrite creates unbacked cover and zeroes valid payouts
- 89424 - [SC - High] a withdrawal at the exact period boundary permanently collapses the period s exposure snapshot voiding paid for cover and denying capacity
- 88572 - [SC - High] a same block boundary withdrawal can mutate committed period start backing and leave settled cover insolvent
- 89428 - [SC - High] inclusive period start snapshot in firelightvault lets any liquidity provider cap incident payouts to near zero and destroy 80 of a period s underwriting capacity
- 88576 - [SC - High] commitallocation can underwrite cover against a period start snapshot that a same block withdrawal rewrites letting lp collateral escape slashing
- 88585 - [SC - High] same block period start withdrawal retroactively changes committed collateral and causes protocol insolvency
- 89499 - [SC - High] same timestamp redemption creates competing withdrawal and cover liabilities against the same collateral
- 88595 - [SC - High] rescuing a not yet claimable withdrawal request permanently poisons the period account pair freezing any later request on that period
- 88597 - [SC - High] same boundary withdrawal mutates committed collateral and causes protocol insolvency
- 89530 - [SC - High] a boundary block withdrawal rewrites committed collateral and makes settled cover unpayable
- 88604 - [SC - High] stale collateral basis in computeavailablecapacity lets a period underwrite cover below the protocol s own minimum backing
- 88615 - [SC - High] stale period start capacity snapshot lets the allocator over sell cover after a mid period payout causing protocol insolvency
- 89549 - [SC - High] rescue leaves a sticky claimed flag that permanently freezes a later same period withdrawal
- 89555 - [SC - High] a staker who times a withdrawal to the exact period start second halves the incident payout and keeps the difference
- 89579 - [SC - High] rescuewithdrawfromblocklisted flags a still open period as claimed without paying anything out permanently bricking the rescued user s next legitimate withdrawal into that same period
- 90066 - [SC - High] function rescuewithdrawfromblocklisted permanently freezes a rescued account s future withdrawals
- 90067 - [SC - High] rescuewithdrawfromblocklisted latches iswithdrawclaimed on a withdrawal bucket that is still accepting credits permanently freezing every later withdrawal credited into it
- 89588 - [SC - High] same block checkpoint overwrite in firelightvault payout lets any depositor escape assessed loss exposure leaving the protocol unable to honour cover it already sold
- 89590 - [SC - High] missing terminal key guard in firelightvault permanently freezes withdrawals after same period rescue and restoration
- 90080 - [SC - High] Period-start redemption appends a deflated exposure checkpoint and underpays valid cover claims
- 89714 - [SC - High] a rescued account can permanently freeze fresh principal in an already claimed withdrawal bucket
- 90086 - [SC - High] inclusive period boundary checkpoint substitution in firelightvault withdraw lets a withdrawing shareholder retain funds owed to an approved claimant
- 89719 - [SC - High] rescuewithdrawfromblocklisted permanently poisons the period account claim flag unrecoverably freezing any later withdrawal into the same still open bucket
- 90087 - [SC - High] same timestamp checkpoint overwrite in firelightvault lets a permissionless boundary withdrawal underpay a valid same period payout
- 89777 - [SC - High] valid target period withdrawal becomes unclaimable after rescue and unblock
- 89793 - [SC - High] rescuewithdrawfromblocklisted marks a not yet elapsed period as claimed permanently locking an unrelated future withdrawal by the same account
- 89803 - [SC - High] A withdrawal at the exact period start rewrites the historical asset snapshot, so approved incident claims are underpaid or paid nothing while the vault still holds the money
- 90104 - [SC - High] rescuing a blocklisted account s withdrawal permanently bricks that account s next withdrawal
- 89811 - [SC - High] a completed compliance rescue permanently poisons the source s withdrawal slot and freezes fresh principal after unblocking
- 90105 - [SC - High] a routine non malicious blocklist rescue permanently poisons the rescued account s next withdrawal with no recovery path for any role
- 90127 - [SC - High] the period start collateral snapshot is still writable inside the boundary block so cover is committed against one basis while the approved claim is capped by a lower one
- 90131 - [SC - High] Boundary-time checkpoint rewrite lets settled-cover collateral escape payouts, causing insolvency
- 90159 - [SC - High] redundant state update in rescuewithdrawfromblocklisted permanently freezes funds for unblocklisted users withdrawing again
- 89854 - [SC - High] same block withdrawal rewrites committed period start assets and makes valid cover payouts zero
- 89856 - [SC - High] Rescue path permanently freezes a user's funds by marking a future period as already claimed
- 89865 - [SC - High] period boundary withdrawal rewrites the period start exposure checkpoint in firelightvault letting a staker evade incident slashing and permanently underpaying the incident payout
- 90183 - [SC - High] rescue tombstone permanently freezes newly funded same bucket withdrawals after unblock
- 88618 - [SC - High] assessment approval can execute a replacement loss schedule the risk consortium never reviewed
- 89908 - [SC - High] mutable period start exposure snapshot in firelightvault payout leads to protocol insolvency approved incident claims underpaid
- 90203 - [SC - High] missing period bound in rescuewithdrawfromblocklisted flags an unstarted period as claimed permanently freezing the account s next withdrawal
- 89929 - [SC - High] inclusive period start lookup lets exact boundary withdrawals reduce incident payouts and potentially cause protocol insolvency
- 89946 - [SC - High] period start withdrawal corrupts collateral accounting allowing settled cover to pay zero while the staker reclaims slashable assets
- 90222 - [SC - High] any staker can halve the protocol s maximum incident payout by landing a withdrawal on the exact period start timestamp
- 89958 - [SC - High] rescuing an unmatured withdrawal lets fresh post unblock shares be burned into a permanently closed period
- 89976 - [SC - High] period boundary checkpoint overwrite in firelightvault lets an unprivileged staker suppress approved incident payouts and deflate underwriting capacity
- 90013 - [SC - High] permanent freezing of user funds due to state corruption in rescuewithdrawfromblocklisted when resolving compliance false positives
- 90357 - [SC - High] rescuewithdrawfromblocklisted latches a withdrawal bucket that is still accepting credits freezing the account s next withdrawal permanently
- 90401 - [SC - High] exact boundary withdrawal overwrites opening exposure and underpays valid claims by 50 at launch leverage
- 90411 - [SC - High] same timestamp checkpoint corruption in withdraw causes theft through underpaid settled cover
- 90415 - [SC - High] rescuewithdrawfromblocklisted marks the period claimed so a later self withdraw cannot be claimed
- 90426 - [SC - High] rescueWithdrawFromBlocklisted permanently freezes later same-period withdrawals for a reinstated account
- 90429 - [SC - High] a period start withdrawal can remove collateral already committed to cover causing a zero vault payout on a valid claim
- 90484 - [SC - High] mutable period start exposure snapshot in firelightvault lets a redeeming lp retain slashable assets and underpays a valid cover claim
- 90488 - [SC - High] exact boundary withdrawal retroactively shrinks the period snapshot after
- 90493 - [SC - High] incorrect claim flag update in the rescuewithdrawfromblocklisted function leads to permanent freezing of restored users funds
- 90497 - [SC - High] stale withdrawal claim flag permanently freezes a new same period withdrawal
- 88619 - [SC - High] stale iswithdrawclaimed flag set by rescuewithdrawfromblocklisted permanently freezes a later legitimate withdrawal by the same account burning the user s shares with no recove
- 88636 - [SC - High] period boundary withdrawal overwrites totalassets exposure checkpoint payout cap collapses to zero and the withdrawer escapes the slash
- 88638 - [SC - High] computeavailablecapacity values the first loss buffer live and the vault at the period start so the vault half of a payout stays in the capital adequacy calculation for the rest
- 88651 - [SC - High] inclusive period start checkpoint lets an exact boundary withdrawal erase incident payout exposure and later reclaim the pending funds
- 88653 - [SC - High] flag collision between rescuewithdrawfromblocklisted and claimwithdraw leads to permanent freezing of user withdrawals
- 88684 - [SC - High] checkpoint overwrites lead to loss of legitimate payouts
- 88688 - [SC - High] coverorderallocator validates capacity against a stale period start snapshot letting cover settle after its collateral backing is paid out and causing protocol insolvency
- 88704 - [SC - High] boundary block redemption rewrites the collateral snapshot after capacity is committed reducing a valid claim by exactly the redeemed amount
- 88705 - [SC - High] rescued account s later same period withdrawal is accepted and burned behind a terminal claim flag permanently freezing user funds
- 88712 - [SC - High] mutable period start snapshot lets lps remove collateral after it has been committed to cover
- 88725 - [SC - High] Rescued withdrawal bucket reuse permanently freezes newly withdrawn funds
- 88741 - [SC - High] c 1 firelightvault rescuewithdrawfromblocklisted permanently poisons a still open withdrawal bucket freezing a staker s funds with no recovery path
- 88753 - [SC - High] boundary snapshot lets withdrawals escape claims
- 88772 - [SC - High] stale claimed flag after compliance rescue permanently freezes a later withdrawal credited to the same period
- 88775 - [SC - High] inclusive period start checkpoint lets a boundary withdrawal escape slashing and underfund a fully collateralized cover claim
- 88783 - [SC - High] backrunning the period start allocation commitment erases the capacity it was validated against leaving sold cover unbacked and the vault leg of a valid claim paying zero
- 88925 - [SC - High] c 2 coverorderallocator contract values collateral at a period start snapshot that a mid period payout never updates so cover is sold paid for and receipted against a vault
- 88968 - [SC - High] cover capacity in coverorderallocator is sized from a period start snapshot that payouts cannot update so cover is sold against collateral that has already been paid out
- 88992 - [SC - High] protocol insolvency and lp fund drain via stale underwriting capacity calculation following cross period payouts
- 89014 - [SC - High] exact boundary checkpoint overwrite underpays approved cover claims
- 89051 - [SC - High] rescue marker collision in firelightvault permanently strands a cleared account s later withdrawal
- 89055 - [SC - High] missing period check in rescuewithdrawfromblocklisted marks a still open period as claimed causing permanent freezing of funds for any withdrawal later requested into that period
- 89071 - [SC - High] withdrawal rescue sets iswithdrawclaimed on an open period bucket making any later withdrawal into that bucket permanently unclaimable
- 89085 - [SC - High] payout s exposure cap snapshot can be corrupted by an ordinary user s withdrawal request landing at a period boundary causing incident claims to be permanently underpaid
- 89090 - [SC - High] a period c payout executed during c 1 is invisible to coverorderallocator s period start capacity snapshot letting a full book of c 1 cover be sold and settled against a vault the
- 89122 - [SC - High] same block period start withdrawal can lower the payout exposure cap after cover capacity is committed
- 89198 - [SC - High] stale collateral snapshot in computeavailablecapacity lets the protocol sell cover against funds it has already paid out driving car to 0 17 against the enforced 1 2 floor
- 89220 - [SC - High] stale iswithdrawclaimed flag written by rescuewithdrawfromblocklisted leads to permanent freezing of funds capital deposited after the compliance action has ended is destroyed
- 89224 - [SC - High] inclusive boundary redemption lets a shareholder retain collateral and underpay a covered claim
- 89234 - [SC - High] rescuewithdrawfromblocklisted tombstones an open bucket permanently locking the user s next withdrawal
Medium
- 88330 - [SC - Medium] post slash zero assets state inverts the erc4626 virtual offset a 1 wei deposit mints half of all shares and captures 50 of all future vault yield
- 88337 - [SC - Medium] cover capacity is read from a period start snapshot so cover committed after an incident payout is priced against collateral the payout already spent
- 88347 - [SC - Medium] rescue writes a terminal claimed flag onto a still open withdrawal bucket permanently trapping the account s next withdrawal
- 88366 - [SC - Medium] Safe signatures for one assessment can trigger 900 additional units of unauthorized depletion
- 88416 - [SC - Medium] post payout share price collapse in firelightvault payout lets an unprivileged 100 wei deposit capture 99 of the slashed lps subsequent premium leading to theft of unclaimed
- 88477 - [SC - Medium] a rescued period user slot remains writable after being marked claimed so a later withdrawal burns the user s shares into a position no one can ever claim
- 89500 - [SC - Medium] a deposit placed right after a payout drains the vault mints shares against a near zero totalassets the premium income pre incident lps underwrote for goes to whoever deposi
- 89511 - [SC - Medium] mutable period start checkpoint lets a covernft callback grief payouts for already settled cover
- 90014 - [SC - Medium] exact timestamp withdrawals at period boundaries permanently corrupt total asset snapshots truncating claim payouts and dos ing cover underwriting
- 90025 - [SC - Medium] a dust deposit after a total loss payout captures approximately 99 of all future vault inflows
- 89556 - [SC - Medium] a boundary withdrawal can zero the capture period exposure cap and prevent incident payouts
- 90033 - [SC - Medium] missing share burn in payout allows a 1 wei deposit to clone the entire lp supply and steal half of all subsequent vault yield
- 89659 - [SC - Medium] exact period boundary deposits and withdrawals corrupt the opening assets checkpoint
- 89677 - [SC - Medium] rescuewithdrawfromblocklisted can pre claim a live withdrawal bucket and make later withdrawals unclaimable
- 90093 - [SC - Medium] a boundary withdrawal changes the period start exposure lookup after capacity is committed causing an approved claim to be underpaid up to zero
- 90102 - [SC - Medium] post slash deposit accounting in firelightvault leads to theft of recovered staker principal
- 89834 - [SC - Medium] an attacker can grief commitallocation when the matchingcapacity is calculated at block timestamp periodstart timestamp
- 89847 - [SC - Medium] unclearable claim flag in rescuewithdrawfromblocklisted causes permanent freezing of staker withdrawals
- 90175 - [SC - Medium] exact period start withdrawal redefines opening exposure and lets an lp evade a valid slash
- 89904 - [SC - Medium] rescuewithdrawfromblocklisted marks a still future withdrawal period as claimed permanently locking any withdrawal the rescued account later makes into that period
- 90282 - [SC - Medium] once payout drives totalassets to 0 with shares still outstanding share pricing degenerates any address can mint totalsupply 1 shares per wei of deposit capturing
- 90409 - [SC - Medium] a slash collapses the share price to near zero and deposits reopen in the same transaction letting anyone mint the vault s entire future value for dust
- 88620 - [SC - Medium] cover capacity in computeavailablecapacity is sized on a stale period start asset snapshot so a prior period payout lets the allocator commit cover against collateral that has
- 88631 - [SC - Medium] firelightvault mint mints shares at zero price after an incident payout drains the vault breaking the erc4626 share price invariant and enabling capture of the recovery inflow
- 88745 - [SC - Medium] h 1 firelightvault deposit mints unbounded shares against a zero asset pool letting a 1 fxrp deposit capture the entire period s premium from the stakers who underwrote it
- 88839 - [SC - Medium] exact boundary checkpoint overwrite suppresses payout exposure
- 89114 - [SC - Medium] permanent denial of service of firelightvault deposit via multiplicative share inflation once totalassets reaches zero through a legitimate payout
- 89130 - [SC - Medium] inclusive period start snapshot in firelightvault lets a same second redeem shrink the payout cap and sold cover capacity leading to griefing of cover claimants
- 89222 - [SC - Medium] a withdrawal at the exact period start second halves the cover payout
- 89238 - [SC - Medium] unblocking after rescue can permanently freeze same period withdrawals
Low
- 88234 - [SC - Low] maxmint and maxdeposit advertise amounts that revert eip 4626 violation
- 88269 - [SC - Low] missing assets 0 guard in firelightvault redeem burns shares for zero assets when share price 1 unfixed variant of macro l 1
- 88292 - [SC - Low] maxmint can overstate remaining mint capacity and return an amount that mint immediately rejects
- 88295 - [SC - Low] maxmint overstates the mintable amount and mint maxmint x x can revert erc 4626 conformance break near the deposit cap
- 88313 - [SC - Low] maxmint floors through converttoshares while mint prices with ceil so the advertised maximum can exceed the deposit limit by the rounding residue
- 89290 - [SC - Low] maxdeposit can advertise a positive amount that deposit deterministically rejects after legitimate rewards
- 88551 - [SC - Low] the capacity guard does not bound vault quantity drift
- 89486 - [SC - Low] incorrect rounding in maxmint causes mint maxmint to revert with depositlimitexceeded violating erc 4626 spec
- 88596 - [SC - Low] firelightvault maxmint returns a share count that mint rejects and maxdeposit an asset amount that deposit rejects
- 89546 - [SC - Low] firelightvault redeem lacks the zero output guard present in deposit burning shares for zero assets when totalassets totalsupply
- 90085 - [SC - Low] the withdraw side of the share asset conversion has no zero output guard so redeem can burn a holder s shares while crediting nothing claimable
- 89812 - [SC - Low] maxdeposit advertises positive capacity that no deposit call can execute after a direct asset transfer
- 89813 - [SC - Low] maxmint overstates the executable cap after a direct asset transfer changes the asset to share ratio
- 89825 - [SC - Low] missing assets 0 guard in firelightvault redeem burns a user s shares for zero withdrawal credit when the share price is below 1
- 90153 - [SC - Low] CR-01 fix bypass: maxMint() converts the absolute cap instead of remaining capacity, causing mint(maxMint) to revert after rewards
- 89876 - [SC - Low] rounding inconsistent maxdeposit and maxmint values can advertise vault entry that necessarily reverts
- 90295 - [SC - Low] maxmint can return an unmintable share amount causing mint to revert and violating erc 4626
- 90310 - [SC - Low] maxmint can return an amount that reverts when passed to mint
- 90313 - [SC - Low] firelightvault can return positive erc 4626 entry maxima that cannot be executed
- 90328 - [SC - Low] period open totalassetsat p start is overwritten by any vault flow in the boundary second mis sizing the payout cap and matching capacity
- 90489 - [SC - Low] firelightvault maxmint returns a share count larger than mint will accept violating eip 4626 s must not be higher than the actual maximum the standard mint maxmint u u in
- 88676 - [SC - Low] firelightvault redeem burns a staker s shares for zero assets records no withdrawal credit and returns success
- 88785 - [SC - Low] firelightvault redeem burns the caller s shares and queues nothing when the redeemed asset value floors to zero the assets 0 guard present on deposit and withdraw is missing
- 88834 - [SC - Low] maxmint overstates the executable mint limit after exchange rate changes
- 88835 - [SC - Low] maxdeposit can advertise an amount that deposit always rejects
- 88960 - [SC - Low] redeem can burn shares while crediting zero assets
- 88973 - [SC - Low] firelightvault maxmint returns a share amount that mint reverts on with depositlimitexceeded because the two functions round in opposite directions across depositlimit
- 88984 - [SC - Low] missing zero value check in redeem silently burns shares for zero assets after totalassets reaches zero
- 89230 - [SC - Low] exact boundary withdrawal can zero an approved payout after cover capacity is committed
Reports by Type
Smart Contract
- 88214 - [SC - High] period p 1 cover capacity is computed from collateral a pending period p claim will consume
- 88231 - [SC - High] rescuing a pending withdrawal permanently poisons that bucket
- 88234 - [SC - Low] maxmint and maxdeposit advertise amounts that revert eip 4626 violation
- 88237 - [SC - High] previous period payouts do not reduce current period cover capacity allowing undercollateralized cover to be sold
- 88244 - [SC - High] stale vault snapshot in computeavailablecapacity lets the allocator underwrite cover against collateral an incident payout already spent breaching the enforced solvency floor pro
- 88254 - [SC - High] rescuewithdrawfromblocklisted permanently poisons the period account claim flag causing unrecoverable freezing of any later withdrawal the account makes into the same still
- 88269 - [SC - Low] missing assets 0 guard in firelightvault redeem burns shares for zero assets when share price 1 unfixed variant of macro l 1
- 88270 - [SC - High] rescuewithdrawfromblocklisted permanently marks period from as claimed bricking future withdrawals for that period and stranding the funds in pendingwithdrawassets
- 88279 - [SC - High] stale period start collateral accounting lets prior period payouts leave newly settled cover fully unbacked
- 88281 - [SC - High] coverorderallocator reuses collateral still backing previous period claims leaving new cover insolvent
- 88286 - [SC - High] requestwithdraw can reuse a withdrawal bucket already closed by rescue permanently freezing fresh user funds
- 88287 - [SC - High] incorrect period boundary checkpoint accounting in firelightvault withdraw lets stakers evade incident slashing and causes protocol insolvency
- 88292 - [SC - Low] maxmint can overstate remaining mint capacity and return an amount that mint immediately rejects
- 88295 - [SC - Low] maxmint overstates the mintable amount and mint maxmint x x can revert erc 4626 conformance break near the deposit cap
- 88308 - [SC - High] totalassetsat resolves a period s opening assets inclusively so a withdrawal in the boundary second redefines the ceiling on every claim against that period
- 88313 - [SC - Low] maxmint floors through converttoshares while mint prices with ceil so the advertised maximum can exceed the deposit limit by the rounding residue
- 88321 - [SC - High] stale period start collateral snapshot lets the allocator sell cover against assets already paid out as claims
- 88330 - [SC - Medium] post slash zero assets state inverts the erc4626 virtual offset a 1 wei deposit mints half of all shares and captures 50 of all future vault yield
- 88337 - [SC - Medium] cover capacity is read from a period start snapshot so cover committed after an incident payout is priced against collateral the payout already spent
- 88338 - [SC - High] Stale vault capacity lets Firelight sell cover against collateral owed to prior claims
- 88343 - [SC - High] a payout after the matcher s capacity read lets stale collateral back new cover and creates an unpaid claim
- 88345 - [SC - High] inclusive period boundary checkpoint lets a staker underfund valid claims
- 88347 - [SC - Medium] rescue writes a terminal claimed flag onto a still open withdrawal bucket permanently trapping the account s next withdrawal
- 88353 - [SC - High] a vault exit mined in the first second of a period writes that period s own exposure snapshot permanently short paying an approved cover claim
- 88366 - [SC - Medium] Safe signatures for one assessment can trigger 900 additional units of unauthorized depletion
- 88395 - [SC - High] claim state poisoning in blocklist rescue permanently freezes a later withdrawal
- 88400 - [SC - High] stale period start capacity checkpoint lets commitments ignore previous period payouts and settle fully unbacked cover
- 88410 - [SC - High] rescue terminalizes a still open withdrawal bucket and permanently freezes post unblock principal
- 88411 - [SC - High] unresolved previous period liabilities are reused to underwrite new cover causing a valid claim to receive zero payout
- 88416 - [SC - Medium] post payout share price collapse in firelightvault payout lets an unprivileged 100 wei deposit capture 99 of the slashed lps subsequent premium leading to theft of unclaimed
- 88420 - [SC - High] rescuewithdrawfromblocklisted sets the same flag claimwithdraw reads as already claimed and never clears it permanently freezing any later withdrawal the account makes into t
- 88425 - [SC - High] rescue marks an open withdrawal bucket claimed and permanently freezes later post unblock principal
- 88473 - [SC - High] mutable period start checkpoint causes protocol insolvency by underpaying approved cover claims
- 88477 - [SC - Medium] a rescued period user slot remains writable after being marked claimed so a later withdrawal burns the user s shares into a position no one can ever claim
- 89272 - [SC - High] stale rescue marker permanently freezes a later withdrawal
- 88479 - [SC - High] rescue flags a still open withdrawal bucket permanently freezing the victim s later withdrawals for that period
- 89281 - [SC - High] anyone can permanently destroy any staker s entire balance for 0 000001 fxrp
- 88489 - [SC - High] stale iswithdrawclaimed flag left by a rescue lets a later same period re withdrawal burn a user s shares into a slot no code path can honor permanent freezing of funds
- 88525 - [SC - High] missing upper bound in addperiodconfiguration leads to permanent freezing of withdrawals
- 89290 - [SC - Low] maxdeposit can advertise a positive amount that deposit deterministically rejects after legitimate rewards
- 88534 - [SC - High] checkpoint accounting desync in the payout function leads to protocol insolvency a withdrawal at the exact period start collapses the exposure cap
- 89303 - [SC - High] rescuewithdrawfromblocklisted marks a still open withdrawal bucket as claimed leading to permanent freezing of funds
- 89315 - [SC - High] Boundary-timestamp withdrawal corrupts the period payout cap, allowing a shareholder to evade slashing and permanently underpay an approved claim
- 88551 - [SC - Low] the capacity guard does not bound vault quantity drift
- 88553 - [SC - High] coverorderallocator uses stale collateral after payouts
- 89319 - [SC - High] exact period boundary withdrawal is included in the period start exposure lookup and permanently underpays the payout receiver
- 88555 - [SC - High] a depositor withdrawing in the exact period boundary block underpays an approved incident claim by their own withdrawal while the vault still holds the money and counts it as payable
- 88565 - [SC - High] capacity uses a period start snapshot a payout cannot lower so cover is sold against collateral already paid out
- 89373 - [SC - High] delayed previous period claims can leave current cover without collateral
- 89401 - [SC - High] withdrawal requested at the exact period start second lowers the payout cap but stays payable so valid claims are underpaid
- 88570 - [SC - High] period boundary checkpoint overwrite creates unbacked cover and zeroes valid payouts
- 89424 - [SC - High] a withdrawal at the exact period boundary permanently collapses the period s exposure snapshot voiding paid for cover and denying capacity
- 88572 - [SC - High] a same block boundary withdrawal can mutate committed period start backing and leave settled cover insolvent
- 89428 - [SC - High] inclusive period start snapshot in firelightvault lets any liquidity provider cap incident payouts to near zero and destroy 80 of a period s underwriting capacity
- 88576 - [SC - High] commitallocation can underwrite cover against a period start snapshot that a same block withdrawal rewrites letting lp collateral escape slashing
- 89486 - [SC - Low] incorrect rounding in maxmint causes mint maxmint to revert with depositlimitexceeded violating erc 4626 spec
- 88585 - [SC - High] same block period start withdrawal retroactively changes committed collateral and causes protocol insolvency
- 89499 - [SC - High] same timestamp redemption creates competing withdrawal and cover liabilities against the same collateral
- 88595 - [SC - High] rescuing a not yet claimable withdrawal request permanently poisons the period account pair freezing any later request on that period
- 89500 - [SC - Medium] a deposit placed right after a payout drains the vault mints shares against a near zero totalassets the premium income pre incident lps underwrote for goes to whoever deposi
- 88596 - [SC - Low] firelightvault maxmint returns a share count that mint rejects and maxdeposit an asset amount that deposit rejects
- 89511 - [SC - Medium] mutable period start checkpoint lets a covernft callback grief payouts for already settled cover
- 88597 - [SC - High] same boundary withdrawal mutates committed collateral and causes protocol insolvency
- 89530 - [SC - High] a boundary block withdrawal rewrites committed collateral and makes settled cover unpayable
- 88604 - [SC - High] stale collateral basis in computeavailablecapacity lets a period underwrite cover below the protocol s own minimum backing
- 89546 - [SC - Low] firelightvault redeem lacks the zero output guard present in deposit burning shares for zero assets when totalassets totalsupply
- 88615 - [SC - High] stale period start capacity snapshot lets the allocator over sell cover after a mid period payout causing protocol insolvency
- 90014 - [SC - Medium] exact timestamp withdrawals at period boundaries permanently corrupt total asset snapshots truncating claim payouts and dos ing cover underwriting
- 89549 - [SC - High] rescue leaves a sticky claimed flag that permanently freezes a later same period withdrawal
- 89555 - [SC - High] a staker who times a withdrawal to the exact period start second halves the incident payout and keeps the difference
- 90025 - [SC - Medium] a dust deposit after a total loss payout captures approximately 99 of all future vault inflows
- 89556 - [SC - Medium] a boundary withdrawal can zero the capture period exposure cap and prevent incident payouts
- 90033 - [SC - Medium] missing share burn in payout allows a 1 wei deposit to clone the entire lp supply and steal half of all subsequent vault yield
- 89579 - [SC - High] rescuewithdrawfromblocklisted flags a still open period as claimed without paying anything out permanently bricking the rescued user s next legitimate withdrawal into that same period
- 90066 - [SC - High] function rescuewithdrawfromblocklisted permanently freezes a rescued account s future withdrawals
- 90067 - [SC - High] rescuewithdrawfromblocklisted latches iswithdrawclaimed on a withdrawal bucket that is still accepting credits permanently freezing every later withdrawal credited into it
- 89588 - [SC - High] same block checkpoint overwrite in firelightvault payout lets any depositor escape assessed loss exposure leaving the protocol unable to honour cover it already sold
- 89590 - [SC - High] missing terminal key guard in firelightvault permanently freezes withdrawals after same period rescue and restoration
- 89659 - [SC - Medium] exact period boundary deposits and withdrawals corrupt the opening assets checkpoint
- 90080 - [SC - High] Period-start redemption appends a deflated exposure checkpoint and underpays valid cover claims
- 90085 - [SC - Low] the withdraw side of the share asset conversion has no zero output guard so redeem can burn a holder s shares while crediting nothing claimable
- 89677 - [SC - Medium] rescuewithdrawfromblocklisted can pre claim a live withdrawal bucket and make later withdrawals unclaimable
- 89714 - [SC - High] a rescued account can permanently freeze fresh principal in an already claimed withdrawal bucket
- 90086 - [SC - High] inclusive period boundary checkpoint substitution in firelightvault withdraw lets a withdrawing shareholder retain funds owed to an approved claimant
- 89719 - [SC - High] rescuewithdrawfromblocklisted permanently poisons the period account claim flag unrecoverably freezing any later withdrawal into the same still open bucket
- 90087 - [SC - High] same timestamp checkpoint overwrite in firelightvault lets a permissionless boundary withdrawal underpay a valid same period payout
- 89777 - [SC - High] valid target period withdrawal becomes unclaimable after rescue and unblock
- 90093 - [SC - Medium] a boundary withdrawal changes the period start exposure lookup after capacity is committed causing an approved claim to be underpaid up to zero
- 89793 - [SC - High] rescuewithdrawfromblocklisted marks a not yet elapsed period as claimed permanently locking an unrelated future withdrawal by the same account
- 90102 - [SC - Medium] post slash deposit accounting in firelightvault leads to theft of recovered staker principal
- 89803 - [SC - High] A withdrawal at the exact period start rewrites the historical asset snapshot, so approved incident claims are underpaid or paid nothing while the vault still holds the money
- 90104 - [SC - High] rescuing a blocklisted account s withdrawal permanently bricks that account s next withdrawal
- 89811 - [SC - High] a completed compliance rescue permanently poisons the source s withdrawal slot and freezes fresh principal after unblocking
- 90105 - [SC - High] a routine non malicious blocklist rescue permanently poisons the rescued account s next withdrawal with no recovery path for any role
- 89812 - [SC - Low] maxdeposit advertises positive capacity that no deposit call can execute after a direct asset transfer
- 90127 - [SC - High] the period start collateral snapshot is still writable inside the boundary block so cover is committed against one basis while the approved claim is capped by a lower one
- 89813 - [SC - Low] maxmint overstates the executable cap after a direct asset transfer changes the asset to share ratio
- 89825 - [SC - Low] missing assets 0 guard in firelightvault redeem burns a user s shares for zero withdrawal credit when the share price is below 1
- 90131 - [SC - High] Boundary-time checkpoint rewrite lets settled-cover collateral escape payouts, causing insolvency
- 89834 - [SC - Medium] an attacker can grief commitallocation when the matchingcapacity is calculated at block timestamp periodstart timestamp
- 90153 - [SC - Low] CR-01 fix bypass: maxMint() converts the absolute cap instead of remaining capacity, causing mint(maxMint) to revert after rewards
- 89847 - [SC - Medium] unclearable claim flag in rescuewithdrawfromblocklisted causes permanent freezing of staker withdrawals
- 90159 - [SC - High] redundant state update in rescuewithdrawfromblocklisted permanently freezes funds for unblocklisted users withdrawing again
- 89854 - [SC - High] same block withdrawal rewrites committed period start assets and makes valid cover payouts zero
- 90175 - [SC - Medium] exact period start withdrawal redefines opening exposure and lets an lp evade a valid slash
- 89856 - [SC - High] Rescue path permanently freezes a user's funds by marking a future period as already claimed
- 89865 - [SC - High] period boundary withdrawal rewrites the period start exposure checkpoint in firelightvault letting a staker evade incident slashing and permanently underpaying the incident payout
- 89876 - [SC - Low] rounding inconsistent maxdeposit and maxmint values can advertise vault entry that necessarily reverts
- 90183 - [SC - High] rescue tombstone permanently freezes newly funded same bucket withdrawals after unblock
- 89904 - [SC - Medium] rescuewithdrawfromblocklisted marks a still future withdrawal period as claimed permanently locking any withdrawal the rescued account later makes into that period
- 88618 - [SC - High] assessment approval can execute a replacement loss schedule the risk consortium never reviewed
- 89908 - [SC - High] mutable period start exposure snapshot in firelightvault payout leads to protocol insolvency approved incident claims underpaid
- 90203 - [SC - High] missing period bound in rescuewithdrawfromblocklisted flags an unstarted period as claimed permanently freezing the account s next withdrawal
- 89929 - [SC - High] inclusive period start lookup lets exact boundary withdrawals reduce incident payouts and potentially cause protocol insolvency
- 89946 - [SC - High] period start withdrawal corrupts collateral accounting allowing settled cover to pay zero while the staker reclaims slashable assets
- 90222 - [SC - High] any staker can halve the protocol s maximum incident payout by landing a withdrawal on the exact period start timestamp
- 89958 - [SC - High] rescuing an unmatured withdrawal lets fresh post unblock shares be burned into a permanently closed period
- 90282 - [SC - Medium] once payout drives totalassets to 0 with shares still outstanding share pricing degenerates any address can mint totalsupply 1 shares per wei of deposit capturing
- 89976 - [SC - High] period boundary checkpoint overwrite in firelightvault lets an unprivileged staker suppress approved incident payouts and deflate underwriting capacity
- 90013 - [SC - High] permanent freezing of user funds due to state corruption in rescuewithdrawfromblocklisted when resolving compliance false positives
- 90295 - [SC - Low] maxmint can return an unmintable share amount causing mint to revert and violating erc 4626
- 90310 - [SC - Low] maxmint can return an amount that reverts when passed to mint
- 90313 - [SC - Low] firelightvault can return positive erc 4626 entry maxima that cannot be executed
- 90328 - [SC - Low] period open totalassetsat p start is overwritten by any vault flow in the boundary second mis sizing the payout cap and matching capacity
- 90357 - [SC - High] rescuewithdrawfromblocklisted latches a withdrawal bucket that is still accepting credits freezing the account s next withdrawal permanently
- 90401 - [SC - High] exact boundary withdrawal overwrites opening exposure and underpays valid claims by 50 at launch leverage
- 90409 - [SC - Medium] a slash collapses the share price to near zero and deposits reopen in the same transaction letting anyone mint the vault s entire future value for dust
- 90411 - [SC - High] same timestamp checkpoint corruption in withdraw causes theft through underpaid settled cover
- 90415 - [SC - High] rescuewithdrawfromblocklisted marks the period claimed so a later self withdraw cannot be claimed
- 90426 - [SC - High] rescueWithdrawFromBlocklisted permanently freezes later same-period withdrawals for a reinstated account
- 90429 - [SC - High] a period start withdrawal can remove collateral already committed to cover causing a zero vault payout on a valid claim
- 90484 - [SC - High] mutable period start exposure snapshot in firelightvault lets a redeeming lp retain slashable assets and underpays a valid cover claim
- 90488 - [SC - High] exact boundary withdrawal retroactively shrinks the period snapshot after
- 90489 - [SC - Low] firelightvault maxmint returns a share count larger than mint will accept violating eip 4626 s must not be higher than the actual maximum the standard mint maxmint u u in
- 90493 - [SC - High] incorrect claim flag update in the rescuewithdrawfromblocklisted function leads to permanent freezing of restored users funds
- 90497 - [SC - High] stale withdrawal claim flag permanently freezes a new same period withdrawal
- 88619 - [SC - High] stale iswithdrawclaimed flag set by rescuewithdrawfromblocklisted permanently freezes a later legitimate withdrawal by the same account burning the user s shares with no recove
- 88620 - [SC - Medium] cover capacity in computeavailablecapacity is sized on a stale period start asset snapshot so a prior period payout lets the allocator commit cover against collateral that has
- 88631 - [SC - Medium] firelightvault mint mints shares at zero price after an incident payout drains the vault breaking the erc4626 share price invariant and enabling capture of the recovery inflow
- 88636 - [SC - High] period boundary withdrawal overwrites totalassets exposure checkpoint payout cap collapses to zero and the withdrawer escapes the slash
- 88638 - [SC - High] computeavailablecapacity values the first loss buffer live and the vault at the period start so the vault half of a payout stays in the capital adequacy calculation for the rest
- 88651 - [SC - High] inclusive period start checkpoint lets an exact boundary withdrawal erase incident payout exposure and later reclaim the pending funds
- 88653 - [SC - High] flag collision between rescuewithdrawfromblocklisted and claimwithdraw leads to permanent freezing of user withdrawals
- 88676 - [SC - Low] firelightvault redeem burns a staker s shares for zero assets records no withdrawal credit and returns success
- 88684 - [SC - High] checkpoint overwrites lead to loss of legitimate payouts
- 88688 - [SC - High] coverorderallocator validates capacity against a stale period start snapshot letting cover settle after its collateral backing is paid out and causing protocol insolvency
- 88704 - [SC - High] boundary block redemption rewrites the collateral snapshot after capacity is committed reducing a valid claim by exactly the redeemed amount
- 88705 - [SC - High] rescued account s later same period withdrawal is accepted and burned behind a terminal claim flag permanently freezing user funds
- 88712 - [SC - High] mutable period start snapshot lets lps remove collateral after it has been committed to cover
- 88725 - [SC - High] Rescued withdrawal bucket reuse permanently freezes newly withdrawn funds
- 88741 - [SC - High] c 1 firelightvault rescuewithdrawfromblocklisted permanently poisons a still open withdrawal bucket freezing a staker s funds with no recovery path
- 88745 - [SC - Medium] h 1 firelightvault deposit mints unbounded shares against a zero asset pool letting a 1 fxrp deposit capture the entire period s premium from the stakers who underwrote it
- 88753 - [SC - High] boundary snapshot lets withdrawals escape claims
- 88772 - [SC - High] stale claimed flag after compliance rescue permanently freezes a later withdrawal credited to the same period
- 88775 - [SC - High] inclusive period start checkpoint lets a boundary withdrawal escape slashing and underfund a fully collateralized cover claim
- 88783 - [SC - High] backrunning the period start allocation commitment erases the capacity it was validated against leaving sold cover unbacked and the vault leg of a valid claim paying zero
- 88785 - [SC - Low] firelightvault redeem burns the caller s shares and queues nothing when the redeemed asset value floors to zero the assets 0 guard present on deposit and withdraw is missing
- 88834 - [SC - Low] maxmint overstates the executable mint limit after exchange rate changes
- 88835 - [SC - Low] maxdeposit can advertise an amount that deposit always rejects
- 88839 - [SC - Medium] exact boundary checkpoint overwrite suppresses payout exposure
- 88925 - [SC - High] c 2 coverorderallocator contract values collateral at a period start snapshot that a mid period payout never updates so cover is sold paid for and receipted against a vault
- 88930 - [SC - Insight] multiple natspec inaccuracies across icoverorderallocator and iincidentmanager produce misleading documentation for integrators
- 88960 - [SC - Low] redeem can burn shares while crediting zero assets
- 88963 - [SC - Insight] capacityconfig field order wastes a full storage slot
- 88968 - [SC - High] cover capacity in coverorderallocator is sized from a period start snapshot that payouts cannot update so cover is sold against collateral that has already been paid out
- 88973 - [SC - Low] firelightvault maxmint returns a share amount that mint reverts on with depositlimitexceeded because the two functions round in opposite directions across depositlimit
- 88984 - [SC - Low] missing zero value check in redeem silently burns shares for zero assets after totalassets reaches zero
- 88992 - [SC - High] protocol insolvency and lp fund drain via stale underwriting capacity calculation following cross period payouts
- 89014 - [SC - High] exact boundary checkpoint overwrite underpays approved cover claims
- 89051 - [SC - High] rescue marker collision in firelightvault permanently strands a cleared account s later withdrawal
- 89055 - [SC - High] missing period check in rescuewithdrawfromblocklisted marks a still open period as claimed causing permanent freezing of funds for any withdrawal later requested into that period
- 89071 - [SC - High] withdrawal rescue sets iswithdrawclaimed on an open period bucket making any later withdrawal into that bucket permanently unclaimable
- 89085 - [SC - High] payout s exposure cap snapshot can be corrupted by an ordinary user s withdrawal request landing at a period boundary causing incident claims to be permanently underpaid
- 89090 - [SC - High] a period c payout executed during c 1 is invisible to coverorderallocator s period start capacity snapshot letting a full book of c 1 cover be sold and settled against a vault the
- 89114 - [SC - Medium] permanent denial of service of firelightvault deposit via multiplicative share inflation once totalassets reaches zero through a legitimate payout
- 89122 - [SC - High] same block period start withdrawal can lower the payout exposure cap after cover capacity is committed
- 89130 - [SC - Medium] inclusive period start snapshot in firelightvault lets a same second redeem shrink the payout cap and sold cover capacity leading to griefing of cover claimants
- 89198 - [SC - High] stale collateral snapshot in computeavailablecapacity lets the protocol sell cover against funds it has already paid out driving car to 0 17 against the enforced 1 2 floor
- 89220 - [SC - High] stale iswithdrawclaimed flag written by rescuewithdrawfromblocklisted leads to permanent freezing of funds capital deposited after the compliance action has ended is destroyed
- 89222 - [SC - Medium] a withdrawal at the exact period start second halves the cover payout
- 89224 - [SC - High] inclusive boundary redemption lets a shareholder retain collateral and underpay a covered claim
- 89230 - [SC - Low] exact boundary withdrawal can zero an approved payout after cover capacity is committed
- 89234 - [SC - High] rescuewithdrawfromblocklisted tombstones an open bucket permanently locking the user s next withdrawal
- 89238 - [SC - Medium] unblocking after rescue can permanently freeze same period withdrawals