Source: v0.8.1-beta (976dcb9e4cf108cf0bc129e7c3e27864f835b537) Target: develop (e6b0c7566f1985ff6edf286ba42d4e48e04a1e19) Report: ChainSecurity_Ammalgam_DLEX_audit_V2_draft.pdf (July 22, 2025) Date: January 28, 2026
Reviewed 51 commits from v0.8.1-beta to develop addressing findings from ChainSecurity’s DLEX audit (V2 draft).
| ID | Title | Severity | Status | Evidence |
|---|---|---|---|---|
| CS-AMMALGAM-001 | Lingering Storage Variable | Critical | FIXED | Version 3 removed transient badDebt variable entirely |
| CS-AMMALGAM-002 | SaturationStruct Is Not Updated for Borrower | High | PARTIALLY_FIXED | Most functions updated but burn()/withdraw() still missing |
| CS-AMMALGAM-003 | Swapped Return Values | High | FIXED | Caller no longer confuses return values |
| CS-AMMALGAM-004 | Users Can Forcefully Be Soft Liquidated | High | FIXED | calcDebtAndCollateral() no longer calls increaseForSlippage() |
| CS-AMMALGAM-005 | Borrow Prices Can Be Too Forgiving | Medium | FIXED | Solvency validation uses reserve-derived price directly |
| CS-AMMALGAM-006 | MaxTrancheOverSaturated Checks Block Functionality | Medium | FIXED | System limits saturation to allowed amount |
| CS-AMMALGAM-007 | TWAP Can Misestimate Price | Medium | FIXED | Denominator computed correctly when buffer not full |
| CS-AMMALGAM-008 | ERC4626DebtToken.borrowCall() Rounding Inconsistent | Medium | FIXED | Borrow call signature changed to pass shares directly |
| CS-AMMALGAM-009 | getLendingStateTick() Unsound Skip | Medium | FIXED | Only uses timeElapsedSinceLendingUpdate == 0 check |
| CS-AMMALGAM-010 | ERC20Base.ownerBurn() Is Not Used | Low | FIXED | Single signature for ownerBurn |
| CS-AMMALGAM-011 | GeometricTWAP Overflow Not Fully Supported | Low | FIXED | Overflows no longer present, tests added |
| CS-AMMALGAM-012 | TokenController.getAssets() Rounds All Down | Low | FIXED | Deposit rounds down, debt rounds up |
| CS-AMMALGAM-013 | feeTo Can Block Liquidations | Low | RISK_ACCEPTED | Per client response |
| CS-AMMALGAM-014 | Comments and TODOs in Code | Informational | PARTIALLY_FIXED | Points 3-6 fixed, 1-2 unresolved |
| CS-AMMALGAM-015 | Generic Callback Method Names | Informational | FIXED | Methods renamed (ammalgamSwapCallV1, etc.) |
| CS-AMMALGAM-019 | Missing Assets Are Not Recalculated | High | NOT_ADDRESSED | Commit 0065bc5a attempts fix but report still lists as open |
| CS-AMMALGAM-020 | recordObservation() Snapshots Wrong Price | High | NOT_ADDRESSED | Commit 17fa46e4 attempts fix with BUFFER_OBS but still open |
| CS-AMMALGAM-021 | withdraw() Does Not Call verifyMaxBorrowXY | High | NOT_ADDRESSED | Open per report - withdraw still missing XY validation |
| CS-AMMALGAM-022 | mintPenalties() Mixes DEPOSIT_L/BORROW_L Pricing | Medium | NOT_ADDRESSED | Commit 13aead26 attempts fix but still open |
| CS-AMMALGAM-023 | quarters == 0 Logic Assumes Positive Movement | Medium | NOT_ADDRESSED | Open per report |
| CS-AMMALGAM-024 | Recursive Leverage Problems | Medium | PARTIALLY_FIXED | CS 5.4 introduces Fragile Liquidity (476ec914) |
| CS-AMMALGAM-025 | swap() Does Not Update Interest | Medium | FIXED | Commit 78e80490 adds accrueSaturationPenaltiesAndInterest() |
| CS-AMMALGAM-026 | verifyMaxBorrowL() Rounding Down | Medium | NOT_ADDRESSED | Open per report |
| CS-AMMALGAM-027 | Dust Deposit Griefing Attack | Low | NOT_ADDRESSED | Open per report |
| CS-AMMALGAM-028 | Outdated 1Inch Token-Plugins | Low | NOT_ADDRESSED | Still uses token-plugins naming |
Files: contracts/AmmalgamPair.sol, contracts/tokens/TokenController.sol Findings addressed: CS-AMMALGAM-019 (attempted) Concerns: Report still lists as open. The fix removes updateMissingAssets calls and calculates on return. Need to verify this adequately addresses the stale missingAssets issue in all paths (mint, burnBadDebt).
Files: contracts/AmmalgamPair.sol, contracts/libraries/constants.sol, test files Findings addressed: CS-AMMALGAM-020 (attempted) Analysis: Introduces BUFFER_OBS and BUFFER_OBS_NUMERATOR constants for depleted case handling. The updateObservation now uses: