Hyperbeat Multi-Asset Withdrawal Queue
About the Protocol
Multi-asset withdrawal queue for Hyperbeat's BoringVault-based vault, supporting queued and instant withdrawals into approved assets.
Findings (3)
Withdrawals processing only works correctly for the base asset
The queue conditionally recalculates withdrawals using only the vault exchange rate, even though non-base assets also depend on an external price, which can overpay users or revert a processing batch.
Missing slippage protection in instant withdrawal function
instantWithdraw(...) accepts an output asset without a caller-supplied minimum, exposing users to unfavorable price or exchange-rate movement before execution.
Magic numbers should be constants
The instant-withdrawal fee calculation uses the literal 10,000 instead of a named basis-points denominator constant.
Ready to secure your project?
Get a free 30-minute security assessment. We’ll review your codebase scope and flag the top 3 risk areas.
No commitment required · Typical audits start within 1–2 weeks