Pre-auditThree days of senior audit time for $1,500, credited in full toward your Zealynx audit.3 audit days, credited toward your auditSee how →
L-10·

Uninitialized `maturityDate` in `Strategy.create()`

Not reportedoptionsleverageblack-scholes
TL;DR

The Strategy.create() function declares a maturityDate return value but never initializes or sets it.

Severity
LOW
Method
MManual review
CAT.

The Strategy.create() function declares a maturityDate return value but never initializes or sets it. This uninitialized value, which defaults to 0, is returned and passed through to OperationalTreasury._buy(), where it's emitted via the LiquidityLocked event.

This leads to misleading or incorrect event logs, particularly showing maturityDate = 0.

The uninitialized value flows through to event emission:

solidity
function _buy(...) internal {
// ...
(sizeUSD, premium, maturityDate) = strategy.create(...);
// maturityDate passed unchanged -> maturityDate: 0
_emitEvent(optionID, amount, sizeUSD, buyToken, premium, fees, maturityDate);
}

Ensure that Strategy.create() explicitly sets and returns a maturityDate.

02Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.

L-10