Security
What has been checked, what has not, and the limits in place until it has.
$5,000
is the most the vault will hold in total until an outside audit is done. The contract refuses any deposit past it.
Outside auditNot yet
Open findings, medium or aboveNone
UpgradesNone possible. There is no proxy
Admin key[Safe address, after deploy]
What was run
Four rounds, each one fixing what the last found and running everything again.
ToolWhat it doesLatest run
FoundryUnit, fuzz and invariant tests135 tests, 111 heavy runs
EchidnaProperty fuzzing11 properties hold
HalmosSymbolic checks18 checks pass
Slither, AderynStatic analysisNothing open above low
MythrilSymbolic executionNothing open above low
Who can do what
CanCannot
YouStart a plan. Stop it on any day the lending market can pay.Touch anyone else's plan.
KeeperSend a buy once it is due.Change the stock, the amount, the destination or the schedule. Withdraw anything.
AnyoneSend a buy that is 12 hours overdue.The same limits as the keeper.
AdminPause new deposits, switch off a route, set the fee up to 10% of interest. Add a route, loosen the price limit or change a price feed after 48 hours in public.Move your money. Stop you from stopping. Upgrade the contracts.
The full list of what the admin can change, and how long each change waits, is on Limits.
Contracts
ContractNetworkAddress
VaultBaseNot deployed yet
Every address the vault talks to is on Contracts.
Found something?
Write to security@dcavault.xyz before telling anyone else. There is no paid bounty yet.