8 Common Vulnerabilities in On-Chain Options Protocols

An option is not merely a token. It is a deferred obligation whose value depends on price, time, collateral, and a future state transition.

That makes on-chain options protocols unusually sensitive to relationships between components. A minting function can work correctly while the system creates more claims than it can settle. An oracle can return a valid price while the protocol selects the wrong observation for expiry. A vault can follow ERC-4626 while its share price ignores an open option liability.

This guide explains the most common options protocol vulnerabilities, why they are subtle, and which invariants developers and auditors should test. The examples combine public reports with generalized patterns observed during private security reviews.

Key points

• Treat every option as a time-dependent obligation, not only as a transferable token.
• Model expiry, price finalization, exercise, redemption, and collateral release as separate states.
• Make each economic claim consumable exactly once across every execution path.
• Reconcile premiums and settled proceeds with the positions and time periods that earned them.
• Require collateral, hedges, oracle data, and liquidation logic to agree on the same economic position.
• Test boundary amounts, adverse decimal combinations, partial fills, and repeated dust operations.
• Prove that essential settlement paths remain executable within realistic gas and integration constraints.
• Attack sequences of individually valid operations. Most serious failures live between functions.

Start with the obligation ledger

Before reviewing code, define what one option unit promises.

For a cash-settled call, the holder may receive the positive difference between the settlement price and strike price. A put reverses that relationship. A physically settled option grants the right to exchange assets under specific conditions. American-style options may be exercised before expiry, while European-style options should not be.

Those distinctions determine the security model. The reviewer should write down:

Question	Why it matters
Who owes value?	Identifies the writer, pool, margin account, or backstop carrying the liability.
Who can claim it?	Defines ownership, transfer, approval, and replay boundaries.
Which asset satisfies the claim?	Determines collateral, decimal, transfer, and liquidity assumptions.
When is the claim valid?	Separates live exercise, expiry, price finalization, and redemption.
Which price defines the payoff?	Fixes the pair, observation time, finality rule, and fallback behavior.
How is the claim consumed?	Prevents double exercise, double fill, and parallel redemption paths.
When can collateral leave?	Prevents withdrawal before every secured obligation is resolved.

Every vulnerability class below breaks one or more lines in this ledger.

1. Claims can be filled, exercised, or redeemed more than once

The first invariant is simple:

Once value is paid for an economic claim, no reachable path can pay for that claim again.

The implementation can enforce this by burning an option token, marking an order hash as filled, decrementing a position balance, or recording a redemption checkpoint. The mechanism matters less than using one authoritative consumed state across all paths.

Parallel functions are the danger. Exercise, redeem, settle, accept a counteroffer, migrate, and emergency withdraw may each look correct in isolation while consuming different state.

A public Putty finding showed this at the order layer. acceptCounterOffer() attempted to cancel an original order and then fill a replacement, but cancellation did not fail when the original order had already been filled. A third party could fill the original first, after which the counteroffer path continued and filled the replacement too. The user received twice the intended exposure. See the public Putty finding.

The 2020 Opyn ETH put exploit demonstrated the same class at exercise time. Transaction-global payment context was effectively reused while exercise logic iterated across vaults. The key lesson from the Opyn postmortem is broader than msg.value: every loop iteration must conserve payment, claim units, and collateral independently.

What to test

• Exercise and redeem the same position through every public and emergency path.
• Fill an order immediately before its cancel-and-replace transaction executes.
• Repeat a batched action across multiple vaults while varying the per-item payment.
• Reenter through token callbacks before the claim is marked consumed.
• Migrate or wrap a claim, then attempt to exercise both representations.

2. Expiry is treated as settlement

Expiry usually closes trading or exercise. It does not necessarily resolve the obligation.

The dangerous period starts at expiry and ends only when the payoff is final and reserved.

If a writer can withdraw because block.timestamp >= expiry, collateral may leave before the settlement observation is known. If a keeper must rebalance or finalize the series during a narrow window, missed execution can strand claims. If the protocol opens a permissionless fallback, the fallback can become an MEV surface when it trades against a manipulable pool.

Liquidity providers face a related timing problem. In a public Buffer Finance finding, LPs could see the price and expiry of outstanding options, then race to withdraw before in-the-money expiries or deposit before out-of-the-money expiries. A short lock period did not align LP capital with the risk period. The finding recommended an epoch-based deposit and withdrawal buffer.

The correct condition

Do not ask only whether an option expired. Ask whether every obligation secured by the collateral is resolved or conservatively reserved.

The protocol should also define what happens when the settlement price never arrives, a dispute remains open, or the normal keeper fails. A fallback must preserve the same economic contract. It should not silently change the price source, observation time, or party bearing slippage.

What to test

• Withdraw after expiry but before price finalization.
• Skip every keeper call and advance beyond each timing window.
• Manipulate the settlement venue immediately before a permissionless fallback.
• Deposit or withdraw immediately before an economically certain expiry outcome.
• Pause at every lifecycle state and verify that valid claims still have a resolution path.

3. Collateral no longer follows the obligation

The core solvency invariant is:

Available and transferable assets must cover outstanding claims under the declared collateral and margin model.

Local health checks are not enough. A vault can pass its individual check while aggregate balances, reserves, or offsets are inconsistent.

A useful global reconciliation is shown above.

The word actual matters. Stored balances do not prove that assets are present, transferable, correctly denominated, or available on the chain where settlement occurs.

Spread and portfolio offsets

Capital-efficient systems reduce margin when a short is paired with a long. That offset is valid only while the long remains an enforceable hedge.

Verify that both legs use compatible:

• underlying and quote assets;
• expiry and exercise model;
• settlement observation and finality rule;
• collateral and payout assets;
• decimal normalization;
• transfer and liquidity assumptions.

The hedge must not be withdrawable while it reduces margin. Nor may one leg expire, settle, or become disputed while the short remains open.

Batched actions

Many options protocols batch deposit, mint, trade, burn, and withdraw operations, then validate the final account state. This is safe only if invalid intermediate states cannot transfer irreversible value, invoke an untrusted integration, or create a claim that survives the batch's validation boundary.

The Opyn Gamma formal specifications are a useful reference because they express protocol properties such as no bankruptcy and valid balance conservation rather than only function-level examples.

4. Premium and vault accounting shift value between user cohorts

Options vaults receive premium before their liabilities are known. Treating that cash as free profit creates an accounting asymmetry.

A defensible model starts with:

economic NAV
  = realizable assets
  + conservative value of confirmed hedges
  - outstanding option liabilities
  - accrued fees and hedging costs

ERC-4626 standardizes share and asset conversions. It does not determine whether totalAssets() represents the economic value of an open derivatives book. The ERC-4626 specification cannot protect a vault whose NAV omits pending exercise losses or counts unconfirmed hedge proceeds.

Withdrawal timing

If the vault recognizes premium immediately but marks liabilities later, an informed LP can redeem at an inflated share price. Remaining LPs absorb the later loss. The reverse can happen when an understated asset or overstated liability lets a new depositor buy too many shares immediately before a favorable update.

Review accounting around:

• option sale and closeout;
• mark and implied-volatility updates;
• expiry and price finalization;
• hedge execution and reconciliation;
• epoch rollover;
• deposit and withdrawal queues;
• fee crystallization.

Entitlements must be time-aware

Pooled proceeds must belong to the positions and time periods that earned them. A new writer or LP should not inherit settled proceeds from risk carried by earlier participants unless the share price or accumulator charges for that value.

We found a similar accounting flaw during a recent private review: entitlements were not aligned with when participants began carrying risk. The lesson is general. Pooled value needs a checkpoint or accumulator that binds each entitlement to the period in which its holder actually carried risk.

Use share-price accounting, cumulative per-share accumulators, or explicit checkpoints so that:

A position created after value accrued cannot claim that historical value for free.

This applies equally to premium, exercise proceeds, trading fees, funding, and loss allocation.

5. Hedging logic turns risk reduction into an attacker-controlled trade

An external hedge is asynchronous state.

The protocol should distinguish intended, submitted, confirmed, and realizable hedge states. Counting an intended or submitted hedge as an asset can manufacture solvency from a trade that never completed. Partial fills, silent integration failures, bridge delays, keeper outages, and off-chain reconciliation all create gaps between those states.

Direction errors are especially dangerous because the system may increase the exposure it intended to reduce. A public Smilee Finance finding showed how an absolute-value boundary check could reverse the sign of a delta hedge amount. Under specific conditions the vault sold when it should have bought, and a user could force large re-hedges around a manipulated pool with tiny trades. See the public Smilee finding.

What to enforce

• Preserve sign before applying magnitude caps or rounding corrections.
• Check actual input spent and output received after every swap.
• Separate slippage protection from a price-limit parameter that permits partial fills.
• Recompute exposure from confirmed balances after the hedge.
• Bound who bears slippage in permissionless or keeper-driven settlement.
• Verify that a tiny user action cannot force an unpriced protocol-sized hedge.

6. Liquidation reduces collateral without reducing risk

Liquidation is not safe merely because an unhealthy account can be called.

The useful property is monotonic:

After liquidation, the remaining account risk must be lower, or the remaining collateral must once again cover the required margin.

For portfolio margin, closing one leg can destroy an offset and make the residual account riskier. The engine must evaluate the post-liquidation portfolio, not subtract debt and collateral independently.

Partial liquidation also creates dust and rounding edges. Repeated minimum-size liquidations can accumulate an advantage that appears harmless in one call. The liquidator bonus must remain bounded by realizable collateral, and the transfer price should use oracle rounds, decimals, and freshness rules coherent with the liquidation trigger.

The public Panoptic audit scope is instructive because it states liquidation and premium properties directly, including limits on liquidator bonuses and conditions under which premium may be paid when a liquidation causes protocol loss. See Panoptic's published protocol invariants.

If insolvency remains possible, model bad debt as a first-class state. Define whether losses go to an insurance fund, backstop, recovery auction, socialized loss mechanism, or governance recapitalization. Otherwise the deficit will reappear as a failed withdrawal or unredeemable claim.

7. Rounding, decimals, and dust break conservation

Options combine strike prices, underlying amounts, oracle decimals, vault shares, fees, and premium accumulators. A single computation can cross several units.

Common failures include:

• division before multiplication;
• values that round down to zero;
• missing, repeated, or mismatched decimal scaling;
• rounding in the wrong economic direction;
• unsafe downcasts after validation;
• partial fills that leave an invalid remainder;
• minimum amounts enforced only when an order is created.

Dacian's Precision Loss Errors provides a useful review format for these classes: isolate the arithmetic step, show the boundary input, identify who benefits from rounding, and repeat the operation to measure cumulative leakage.

Two public findings show why this matters for options and vaults:

• A Putty finding showed how a small strike and rounded fee could produce a zero-value transfer that some tokens reject, blocking withdrawal.
• An OpenZeppelin volatility-vault finding showed a withdrawal amount rounding down to zero shares while still transferring non-zero assets. Repeating the call could drain the vault.

Audit every equation with units

Annotate variables before simplifying:

strike: quote units per underlying unit
amount: underlying token units
scale: 10 ** underlying decimals
payout: quote token units

Then test:

• one unit below the rounding boundary;
• exactly at the boundary;
• one unit above it;
• 6, 8, 18, and unusually low or high decimals;
• repeated minimum-size operations;
• maximum values before every downcast;
• both rounding directions and the party each direction benefits.

8. Privileged changes rewrite existing financial contracts

Once an option series exists, its economic identity should not change. That identity includes the underlying, strike, collateral, expiry, exercise model, settlement method, oracle rule, and fees that affect payout.

A public Putty finding showed that a mutable fee could change between order fill and withdrawal, altering the user's expected outcome after the position already existed.

For each privileged setter, ask:

• Does it affect existing series or only future series?
• Can it change collateral requirements or unlock conditions?
• Can it replace an oracle near expiry?
• Can a hot operational role reach owner-level configuration through a wrapper or multicall?
• Is the change delayed, bounded, and emitted clearly?
• Can emergency powers stop new risk while preserving valid claims?

An upgrade that preserves token balances can still change what those balances are entitled to receive.

How vulnerabilities compose

The highest-impact failures usually cross several classes.

Expiry plus premature withdrawal

1. An option expires.
2. Its settlement price remains pending.
3. The writer withdraws because the position is marked expired.
4. The final price makes the option valuable.
5. Holders own valid claims against missing collateral.

Stale pricing plus liquidation

1. The mark price becomes stale during volatility.
2. An account remains incorrectly classified as healthy.
3. Its deficit grows beyond available liquidation incentives.
4. A later update reveals insolvency.
5. Liquidation cannot restore solvency without bad debt.

Premium accounting plus LP timing

1. A vault sells options and recognizes premium as profit.
2. The open liability is absent or stale in NAV.
3. An informed LP redeems at the inflated share price.
4. The option loss settles later.
5. Remaining LPs absorb value extracted by the early redeemer.

Hedge failure plus optimistic accounting

1. A vault submits an external hedge.
2. Internal accounting treats the hedge as confirmed.
3. The trade partially fills or silently fails.
4. Users withdraw against overstated assets.
5. The option liability remains while the assumed hedge does not.

Property-test catalog

A serious options review should turn the threat model into executable properties.

Single-use claim

total value paid for a claim <= its defined payoff

Collateral conservation

actual transferable assets
  >= withdrawable balances + reserved claim obligations + accrued fees

Withdrawal safety

successful withdrawal -> every remaining account is valid and the system remains solvent

Include the interval after expiry but before final settlement.

Settlement immutability

After final settlement, the price and series parameters cannot change, a settled vault cannot reopen, and a redeemed claim cannot regain value.

Accounting fairness

A deposit immediately followed by a withdrawal, without economic change, cannot return more assets than were deposited except for explicit, bounded transfers.

Repeat the property across mark updates, hedge reconciliation, expiry, and epoch rollover.

Time-aware entitlement

new shares or writer tokens cannot claim proceeds accrued before their checkpoint

Liquidation monotonicity

post-liquidation deficit <= pre-liquidation deficit

Test minimum and maximum amounts, repeated operations, offset removal, and adverse decimals.

Liveness

Every valid claim remains settleable with bounded work even if one keeper, token, market, or queue item fails.

Order independence

Where two operations are documented as independent, permuting them must not alter claim supply, collateral ownership, or solvency. Where order intentionally matters, encode and test the dependency.

An auditor's workflow

1. Build the obligation ledger. List every claim and the asset or action required to satisfy it.
2. Draw the state machines. Map series, claim, vault, oracle, liquidation, queue, and emergency states.
3. Reconcile assets against claims. Compare internal accounting, actual balances, external positions, and claim supply.
4. Trace value with units. Annotate decimals, rounding direction, and who benefits at each arithmetic step.
5. Attack transaction ordering. Permute operations around expiry, oracle updates, hedges, deposits, withdrawals, and callbacks.
6. Remove trusted automation. Skip keepers, delay oracles, partially fill swaps, and fail one queue item.
7. Test invariants continuously. Use stateful fuzzing and formal properties, not only example-based unit tests.

Conclusion

The dangerous question in an options protocol is not whether each function works. It is whether the same economic obligation survives creation, trading, collateral management, exercise, expiry, pricing, hedging, liquidation, and settlement.

Secure designs make those transitions explicit. They bind each claim to sufficient collateral, use one deterministic settlement rule, account for premium and liability together, preserve time-aware entitlements, and ensure that liquidation and hedging reduce risk rather than disguise it.

CODESPECT reviews options protocols through business-logic analysis, economic attack modeling, and invariant testing. If you are preparing an options protocol or vault for launch, request a security assessment.

Technical references

• Solodit findings explorer documentation
• Opyn ETH put exploit postmortem
• Opyn Gamma formal specifications
• Panoptic public audit scope and invariants
• ERC-4626 tokenized vault standard
• Dacian, Precision Loss Errors
• OpenZeppelin, Pods Finance Ethereum Volatility Vault Audit #1

Related CODESPECT resources

• Web3 security reviews
• Our audit methodology
• Implementation and security pitfalls of LSTs on Hyperliquid