StVault is a deliberately vulnerable Solidity lending vault built to demonstrate a bounded security-review workflow: define the scope, identify concrete issues, write executable proofs of concept, document the findings, and verify the remediations.
Demonstration only. This repository is not production code and does not represent a client engagement. The findings apply to the reviewed demo contract at commit
6e0fc09; they are not a claim that the design is otherwise complete or production-ready.
| ID | Severity | Vulnerable-branch proof | Remediation check |
|---|---|---|---|
| H-01 | High | test_H01_StaleOracle_DrainsPool |
test_H01_StalePrice_NowRejected |
| M-01 | Medium | test_M01_Reentrancy_DrainsCollateral |
test_M01_Reentrancy_NowBlocked |
| L-01 | Low | test_L01_FeeRounding_UnderCharged |
test_L01_Fee_NowExact |
The vulnerable proofs are in the master branch's
test/StVault.poc.t.sol. The corresponding remediation
checks are in the fixed branch.
The two suites exercise equivalent scenarios with different expected outcomes; they
are not byte-for-byte identical tests.
| ID | Severity | Summary |
|---|---|---|
| H-01 | High | The price-feed read omits freshness, sign, and decimal validation, allowing stale pricing to support excessive borrowing. |
| M-01 | Medium | withdrawCollateral transfers before clearing state and lacks a reentrancy guard, allowing a hook-enabled token to drain collateral. |
| L-01 | Low | Division before multiplication truncates the origination fee and systematically under-collects protocol revenue. |
Read the accessible source report in REPORT.md or the formatted
StVault_Security_Review.pdf for scope, impact,
severity rationale, code references, and recommendations.
| Branch | Purpose | Meaning of a passing test suite |
|---|---|---|
master |
Reviewed vulnerable target and exploit PoCs | The documented vulnerabilities are reproduced. |
fixed |
Remediated target and regression tests | The documented exploit scenarios are rejected or bounded. |
The CI workflow tests the actual pull-request head. On pushes and manual runs, it also checks both canonical branches so the vulnerable and remediated evidence remain executable together.
Install Foundry, then run:
git clone --recurse-submodules https://github.com/Musyg/stvault-audit.git
cd stvault-audit
# Vulnerable branch: the exploit PoCs succeed.
git checkout master
forge test -vvv
# Remediated branch: the regression checks succeed.
git checkout fixed
git submodule update --init --recursive
forge test -vvvDependencies are pinned as Git submodules. See SECURITY.md before
reporting an issue in this deliberately vulnerable demonstration.
Severity uses a review-specific Impact x Likelihood matrix documented in the report. It communicates the consequence and practical preconditions of each finding within this demo's stated scope; it is not a transferable score for unrelated systems.
Gilles Musy, smart-contract security researcher.
Public profiles: GitHub, Code4rena, and Cantina. These external profiles are separate from this demonstration repository.