Dripster Leveraged Prediction Vault
Zealynx audited the Dripster Leveraged Prediction Vault, a custodial EVM smart contract suite that opens leveraged positions on Polymarket Conditional Token Framework markets. The 1,825 nSLOC review across seven Solidity files identified 17 issues (2 Medium, 7 Low, 8 Informational) with zero Critical or High findings, reflecting an iteratively-hardened codebase. Nine findings were fixed and eight acknowledged.
Total findings
17
9 fixed · 8 acknowledged
Critical
00
High
00
Medium
02
Low + Info
15
02
Scope
7 files · 1,825 SLOCRepository
Initial commit
4b5dd35ed922
Platform
Polygon · Solidity
Methodology
Out of scope
frontend / UI, ML models, third-party dependencies, off-chain infrastructure, API / backend (audited separately)
File
LeveragedPredictionVaultV1.sol
PositionLib.sol
SignatureLib.sol
CloseLib.sol
Events.sol
Types.sol
Errors.sol
03
Findings
click any row for the full write-upSeverity
ID
Finding
Status
04
Key Findings
- Emergency mode blocks escape-hatch refund paths, trapping user funds. The
whenNotEmergencyOnlymodifier is applied tocancelPosition,revertOpen, andfinalizeClose, the very functions that exist to refund funds caught in transitional states during incidents. The team agreed to add a self-cancel path gated by the existingserverHaltedflag, preserving the conservative posture during normal operation while giving users a non-custodial exit during a declared incident. - Storage slot annotations off, creating a V2 upgrade hazard. All 28 inline slot annotations in the contract assumed OpenZeppelin v4 sequential base storage rather than v5 ERC-7201 namespaced storage. A V2 author trusting the comments could place a new variable at "slot 0", overwriting
globalAdminafterupgradeToAndCalland corrupting governance. - Incomplete
rescueERC1155guard allows draining tokens from active positions. The original guard usedtokenTotalBorrowedUsdcUnits[tokenId] > 0as a proxy for "active position holds this tokenId". After a force-unwind drains borrowed capital to zero while the position retains its conditional tokens, the proxy reads zero andglobalAdmincan rescue tokens out from under the position, bricking every subsequent close, settle, or liquidate. The same surface was independently flagged by the Krait pre-audit from the inverse angle, confirming the rescue guard as the correct remediation site.
05
Architectural Security Observations
- Graduated four-tier operational controls. Pause mechanisms are tiered (
newPositionsPausedtouserActionsPausedtoemergencyOnlyModetoserverHalted), allowing scoped incident response rather than a binary kill switch. - Asymmetric admin authority with timelock gating. Four-role separation plus a
TimelockControlleron every high-risk operation.emergencyAdmincan pause but onlyglobalAdmincan unpause, preventing a hot key from re-enabling the protocol after a halt. - Two-step backend-coordinated lifecycle. Position transitions split into on-chain initiation, off-chain Polymarket execution (Fill-Or-Kill, no resting-order windows), and on-chain finalization, with explicit
*Pendingstates. - EIP-712 typed-data signatures with chain-bound domain. Position payloads are signed via EIP-712 with the OpenZeppelin v5 namespaced domain separator: wallet-side transparency plus cross-chain replay prevention via
chainid()andaddress(this). - Concurrent unwind plus liquidate state isolation. Separate
pendingTokenUnitsandpendingUnwindTokenUnitsfields permit a force-unwind and liquidation to interleave without data corruption; terminalfinalizeForceUnwindfromLiquidatedavoids double-decrementing capital tracking. - Contract-wide invariant enforcement.
_assertPositionInvariantsruns at every state-mutating exit, locking in core position identities.
06
Security Strengths Observed
- Iteratively-hardened codebase. Extensive
AUDIT-FIXannotations reflect multiple prior security review iterations. The Krait pre-audit (1 Low fixed, 4 Informational acknowledged) predated manual review, showing automated tooling is part of the development loop. - Deferred fee accrual eliminates create-to-open race. Origination fees are reserved as
pendingOriginationFeesUsdcUnitsatcreatePositionand only realized intoaccumulatedFeesUsdcUnitsatfinalizeOpen, with refund on partial fills. - Modern Solidity practices. Custom errors,
SafeERC20,nonReentranton every state-mutating entry point, strict CEI ordering, and OpenZeppelin v5 upgradeable patterns with_disableInitializers()in the implementation constructor. - Defense-in-depth on backend trust. Soft sanity checks (
isWithinBoundsat 5x/10x tolerance) catch inconsistent submissions; off-chainVaultEventAlertServicemonitors every finalize event with automatic circuit-breaker tripping at 5,000 USDC bad debt. - High test-suite sensitivity. Mutation testing yielded a 99% high-severity catch rate. Surviving mutants were classified as equivalent or covered by the calibrated invariant layer added during this audit.
07
Team & approval
Lead Auditor
Carlos (Bloqarl)
@TheBlockChainer
Auditor
Bobby_Petrov
@0x_bob_0x
08
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
