Early rate$2,400 of senior audit time for $500. Early members keep the rate as it climbs.$2,400 of senior audit time for $500See how →
F-2025-0007·access-control

Inability to delegate claim permissions by users

FixedlendingmonadveToken
TL;DR

Users had no way to delegate reward-claim permission to a third party (a keeper bot, a custodian, or an automation contract). All claim transactions had to come directly from the veNFT owner, limiting the protocol's composability.

Severity
MEDIUM
Impact
MEDIUM
Likelihood
MEDIUM
Method
MManual review
CAT.
Complexity
LOW
Exploitability
MEDIUM
02Section · Description

Description

The reward claim path required the call to come from the veNFT owner directly. There was no delegation surface allowing the owner to authorize another address (keeper, automation contract, custodian) to claim on their behalf, which is a common requirement for institutional users and gas-efficiency keeper patterns.

03Section · Impact

Impact

Reduced composability for users who want keepers, automation, or custody arrangements. Forced manual claims by the owner address for every position.

04Section · Recommendation

Recommendation

Add a delegation registry that lets a veNFT owner authorize specific addresses to claim on their behalf, with revocation. Emit events on delegate/revoke for off-chain indexing.

Composable Security ID: NRL-6c19a5e-M03. Neverland Money: Fixed. Composable Security: Fix verified during retest.

Status
Fixed
Fix commit
816c394500f1
Fix date
2025-08-22
F-2025-0007