Wedefin
Zealynx audited the Wedefin protocol, a decentralized index fund whose asset allocation is dictated by a community competition of trader-built portfolios ranked on-chain by liquidity, volatility, and profit. The review covered 15 Solidity contracts (1,294 nSLOC) including the portfolio, manager, ranker, swap, lender, and treasury modules. It identified 17 issues: 3 High (including a treasury reentrancy draining all ETH), 8 Low, and 6 Informational suggestions. All findings were acknowledged.
Scope
15 files · 1,294 SLOCFindings
click any row for the full write-upKey Findings
- Missing
refundETH()inWEDXswap::swapNative. SwapRouter swaps that end with unspent ETH (price limit hit, partial liquidity, positive slippage) leave that ETH inside the router, where anyone can claim it viarefundETH(), causing direct user loss. - Reentrancy in
WEDXIndexPortfolio.supplyLendTokenandwithdrawLendToken. Aave lending calls happen before state updates and ERC-777tokensToSend/tokensReceivedhooks let a malicious token reenter, manipulating balances or duplicating supplies and withdrawals. WEDXTreasuryETH can be drained by anyone via reentrancy inredeem.redeemsends ether before burning the caller's tokens; a contract callback re-enters with the sameamountToRedeemuntil the treasury balance is zero.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
