Protocol
Security
What has been checked, what was fixed, and what is still open. Stated plainly.
Status
Security review, 12 November 2026
The contract was reviewed against a fixed set of security checks. Five issues were fixed the same day. The full report is in the repository: security-audit-2026-11-12.md.
| Severity | Fixed issue |
|---|---|
| Critical | Deposits and margin withdrawals were possible in markets that were not open. Mode checks added. |
| Critical | The price callback changed engine state. It now only stores the observation. |
| High | Liquidation was possible at a stale price. A freshness check was added. |
| High | Reduce-only mode was not enforced on order execution. It is now. |
| Medium | Expired orders were not removed from storage. They are now. |
Known open items
- The owner key can create markets directly and replace the oracle account without a timelock. This is disclosed and limited to the hackathon period.
- A market that drops to reduce-only after a price-band breach has no automatic way back to active.
- Orders that reduce the pool's imbalance are charged the full dynamic spread instead of the minimum. Traders are overcharged, never undercharged.
- The 24 hour pool redeem delay is not implemented yet.
- Pool pricing assumes tokens with 6 decimals.
What is tested
| Check | Result |
|---|---|
| Contract unit tests | 48 passing |
| Sandbox tests on a real NEAR runtime | 2 passing: full trade flow, and pool price read |
| Risk engine | Kani proofs and property tests in crates/engine |
| Custody | Contract USDC is at least the sum of all balances, checked after every call in tests |
| Admin | A test confirms admin methods do not change any balance |
Access control
- Every value-moving user call requires
1yoctoNEAR, so it must be signed by a full-access key. - Deposits are accepted only from the configured USDC contract.
- Callbacks are private to the contract.
- The pauser role can only tighten a market: active to reduce-only to price-uncertain. It cannot loosen it.
- There is no method that lets an admin move user funds.
After the hackathon the owner key moves to a 2-of-3 multisig with a timelock.
Report a vulnerability
Contact the team at @neapdex before disclosing publicly.