Source: v0.8.1-beta (976dcb9e4cf108cf0bc129e7c3e27864f835b537) Target: develop (e6b0c7566f1985ff6edf286ba42d4e48e04a1e19) Report: ChainSecurity_Ammalgam_DLEX_audit_V2_draft.pdf (July 22, 2025) Date: January 28, 2026
Reviewed 51 commits from v0.8.1-beta to develop addressing findings from ChainSecurity’s DLEX audit (V2 draft).
| ID | Title | Severity | Status | Evidence |
|---|---|---|---|---|
| CS-AMMALGAM-001 | Lingering Storage Variable | Critical | FIXED | Version 3 removed transient badDebt variable entirely |
| CS-AMMALGAM-002 | SaturationStruct Is Not Updated for Borrower | High | FIXED | Token transfer to pair triggers validateOnUpdate() via ERC20Base._update() hook |
| CS-AMMALGAM-003 | Swapped Return Values | High | FIXED | Caller no longer confuses return values |
| CS-AMMALGAM-004 | Users Can Forcefully Be Soft Liquidated | High | FIXED | calcDebtAndCollateral() no longer calls increaseForSlippage() |
| CS-AMMALGAM-005 | Borrow Prices Can Be Too Forgiving | Medium | FIXED | Solvency validation uses reserve-derived price directly |
| CS-AMMALGAM-006 | MaxTrancheOverSaturated Checks Block Functionality | Medium | FIXED | System limits saturation to allowed amount |
| CS-AMMALGAM-007 | TWAP Can Misestimate Price | Medium | FIXED | Denominator computed correctly when buffer not full |
| CS-AMMALGAM-008 | ERC4626DebtToken.borrowCall() Rounding Inconsistent | Medium | FIXED | Borrow call signature changed to pass shares directly |
| CS-AMMALGAM-009 | getLendingStateTick() Unsound Skip | Medium | FIXED | Only uses timeElapsedSinceLendingUpdate == 0 check |
| CS-AMMALGAM-010 | ERC20Base.ownerBurn() Is Not Used | Low | FIXED | Single signature for ownerBurn |
| CS-AMMALGAM-011 | GeometricTWAP Overflow Not Fully Supported | Low | FIXED | Overflows no longer present, tests added |
| CS-AMMALGAM-012 | TokenController.getAssets() Rounds All Down | Low | FIXED | Deposit rounds down, debt rounds up |
| CS-AMMALGAM-013 | feeTo Can Block Liquidations | Low | RISK_ACCEPTED | Per client response |
| CS-AMMALGAM-014 | Comments and TODOs in Code | Informational | PARTIALLY_FIXED | Points 3-6 fixed, 1-2 unresolved |
| CS-AMMALGAM-015 | Generic Callback Method Names | Informational | FIXED | Methods renamed (ammalgamSwapCallV1, etc.) |
| CS-AMMALGAM-019 | Missing Assets Are Not Recalculated | High | FIXED | missingAssets() calculates on-the-fly (commit 0065bc5a) |
| CS-AMMALGAM-020 | recordObservation() Snapshots Wrong Price | High | FIXED | Commit 17fa46e4 records more severe price for borrower pressure (test Cantina319_PoC) |
| CS-AMMALGAM-021 | withdraw() Does Not Call verifyMaxBorrowXY | High | FIXED | Commit 85735c78 replaces verifyMaxBorrowL with verifyMaxBorrowXY |
| CS-AMMALGAM-022 | mintPenalties() Mixes DEPOSIT_L/BORROW_L Pricing | Medium | FIXED | Commit 13aead26 - uses BORROW_L for penalty calculation |
| CS-AMMALGAM-023 | quarters == 0 Logic Assumes Positive Movement | Medium | FIXED | Commit 07f6a58f refactors tranche handling (closes #1049) |
| CS-AMMALGAM-024 | Recursive Leverage Problems | Medium | FIXED | Fragile Liquidity (476ec914) - see test fuzz_testRecursiveBorrowMaxBorrow |
| CS-AMMALGAM-025 | swap() Does Not Update Interest | Medium | FIXED | Commit 78e80490 adds accrueSaturationPenaltiesAndInterest() |
| CS-AMMALGAM-026 | verifyMaxBorrowL() Rounding Down | Medium | FIXED | Commit 440388d7 changes rounding to round UP (true) |
| CS-AMMALGAM-027 | Dust Deposit Griefing Attack | Low | FIXED | Commit 94107400 - repay shares fix addresses griefing vector |
| CS-AMMALGAM-028 | Outdated 1Inch Token-Plugins | Low | FIXED | Commit e2d62028 syncs 1inch lib, renames plugin to hook |
Status: FIXED Analysis: Version 3 removed transient badDebt variable entirely, eliminating the attack vector.