Hyperwave Sub-Account Strategy Framework
About the Protocol
Sub-account strategy framework for Hyperwave's BoringVault-based vault, letting strategists deploy vault funds into external protocols under Merkle-gated permissions and per-strategy limits.
Findings (14)
Repayment path reverts if a blocklist-capable baseAsset blocks the strategy or the vault
A blocklist-capable base asset like USDC can revert repayments if the strategy or vault address is blocked, freezing that strategy's debt reduction.
transferFundFromVault(...) uses unchecked transfer(...) call
A raw transfer(...) call to move funds from the vault ignores its return value, risking silent accounting desync on a non-reverting token.
withdraw(...) slippage floor misprices staker shares when unstake is true
Pricing withdrawal shares against the unstaked preview overstates the payout for staked positions, reverting legitimate withdrawals.
transferFundBackToVault(...) floors allocated to zero while transferring the full amount
Flooring an over-repayment's allocated balance to zero while transferring the full amount leaves the excess untracked.
Slippage floors collapse to zero on deposit(...) and withdraw(...)
Small deposit or withdraw amounts can round the slippage floor to zero, removing the only on-chain slippage protection.
Ready to secure your project?
Get a free 30-minute security assessment. We’ll review your codebase scope and flag the top 3 risk areas.
No commitment required · Typical audits start within 1–2 weeks