MMystic Finance · Smart Contract Security AssessmentMystic Finance Client Hub

Octarine RFQ Founder Security Sprint

Founder Security Sprint and mitigation review of Mystic Finance’s Octarine RFQ core and four shared oracle contracts. The final report dated 28 October 2026 records 15 findings: four Medium and eleven Low; nine Fixed, two Mitigated and four Acknowledged. Residual owner, signer, schedule, source-health and order-lifecycle conditions remain documented.

EthereumPlumeSoliditySmart Contract Code Review2026-10-28Zealynx methodology

Total findings

9 fixed · 2 mitigated · 4 acknowledged

Critical

High

Medium

Low + Info

Scope

5 files · 466 SLOC

Initial commit

157c3ff4c701

Final commit

5f7beb4

Platform

Ethereum · Plume · Solidity

Methodology

Zealynx audit methodology

Out of scope

Escrow, Dutch-auction, vault, redemption-vault, instant-pool and Rincewind contracts, except where the in-scope code relies on their behaviour.

File

src/octarine-rfq/OctarineRFQ.sol

src/shared/oracles/OctarineOracleBase.sol

src/shared/oracles/OctarineChainlinkOracle.sol

src/shared/oracles/OctarineCallOracle.sol

src/shared/oracles/OctarineThirdPartySetterOracle.sol

Findings

click any row for the full write-up

Severity

Finding

Status

mediumM-01After invalidate(), the first push from any signer sets an unbounded price that honest signers cannot correctFixed›mediumM-02CYCLICAL schedules roll by a fixed cycle, so after a missed keeper update fills near each month-end are charged the wrong side of the redemption dateMitigated›mediumM-05The schedule has no notion of a redemption request cutoff, so fills after the filing deadline are charged for a payout the maker can no longer reachFixed›mediumM-06OctarineCallOracle cannot refuse a price its own source flags as invalid: a defaulted Pareto tranche keeps settling at its pre-default price, and ULTRA's x100 unit change re-prices the routeFixed›lowL-02The submitter's gas limit can starve a healthy direct CallOracle read, so the fill is priced on the triangulated routeMitigated›lowL-03The Chainlink adapter rejects every Chronicle answer (startedAt is always 0), so Chronicle-priced assets cannot be filled or are silently repricedFixed›lowL-04Setter oracle accepts guard values that switch off its bounds, so one signer key can move the price without limit in a single blockFixed›lowL-05The maker leg's measured receipt is not clamped, so a token that credits balances mid-transfer lets a fill settle below the taker's signed floorFixed›lowL-06A relayed fill publishes the taker's signed request, so a competing maker can front-run the winning bid and fill at the taker's floorAck›lowL-07One compromised setter signer can take every update slot, so honest signers cannot correct a walked price and extra signers add no protectionFixed›lowL-08A delegated signer's cancelSalt under its own address succeeds and emits SaltCancelled, but the orders it signed stay fillableAck›lowL-09The Chainlink adapter rejects every answer from the Stork feeds Morpho uses for Nest assets on Plume, because Stork reports timestamps in nanosecondsFixed›lowL-10The filler of an open quote cannot set a minimum, so a schedule or price move between its simulation and settlement is charged to it in fullFixed›lowM-03Revoking a delegated order signer only pauses it: registering the same key again revives every unexpired order it signedAck›lowM-04CallOracle without a timestamp call reports every read as fresh, so the RFQ's mandatory staleness bound never applies to issuer-set ratesAck›

Final report

The 85-page final report, dated 28 October 2026, records the original scope, evidence, individual findings, mitigation review and final dispositions. Its exact SHA-256 is 2092f6cef9253b5f49ae58b3ed75165823111c49de0ad46a332c208e2a1ac022.

Remediation outcomes and residual conditions

There are 15 findings: four Medium and eleven Low. The final dispositions are nine Fixed, two Mitigated and four Acknowledged. Original IDs are retained: M-03 and M-04 were regraded Low at final review. The identifier does not override the final severity shown on each page.

A Fixed label is the report's specific remediation conclusion, not a claim that every related risk disappeared. The setter-oracle owner remains trusted with the price after reset; the signer rate control still permits one step per signer per interval. The CYCLICAL schedule and direct-read gas changes are recorded as mitigations with their conditions. Re-enabling delegated keys can revive old orders, sources without timestamps still depend on operational health, relayed open requests still need sender binding, and delegated cancellation retains its documented semantics. Read the full final mitigation paragraphs on the individual pages before relying on any disposition.

Reviewed scope and limits

The frozen initial scope is the Octarine RFQ core and four shared oracle contracts at 157c3ff4c701f2974e58c9847519741dcaade464, reported as 466 nSLOC (608 code lines). Remediation was reviewed at 5f7beb4 as identified in the final report. Other facilities and later revisions are outside that stated scope, except for behaviour on which the reviewed code relies.

This is a time-limited security review, not a guarantee of complete vulnerability discovery, deployment safety or future operational security. The public write-ups reproduce the report's findings and final conditions; they do not constitute a new audit of current deployments.

Team & approval

Lead Auditor

Carlos (Bloqarl)

@TheBlockChainer

Disclaimer

This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.

Download PDF (85p)