DeFi protocol audits
A DeFi audit has to check the code and the economics. HYDN reviews lending markets, DEXs, yield and derivatives protocols line by line for reentrancy, access control and upgrade risk, then models how an attacker with a flash loan, a manipulated price or a large position would try to profit. Most DeFi audits take 2 to 4 weeks.
What we look at
Code level flaws
- Reentrancy, including cross-function and read-only reentrancy through view functions other protocols depend on.
- Access control on every privileged function, initialiser and emergency path.
- Upgradeability: storage layout, initialisation and who controls the upgrade.
- Token handling: fee-on-transfer, rebasing and non-standard ERC-20s, and callbacks from ERC-777 or ERC-721 receivers.
Economic and market flaws
- Price manipulation. Any price read from a pool’s spot reserves can be moved within one transaction. We check where your protocol reads prices and what an attacker gains by moving them. See oracle manipulation.
- Flash loan amplification. We assume the attacker has effectively unlimited capital for the length of one transaction. See flash loan attacks.
- Rounding direction. Share and interest calculations that round in the user’s favour can be repeated until they add up to real money. See rounding and precision errors.
- Liquidation logic. Bad debt, liquidations that cannot be profitably executed, and positions that cannot be liquidated at all.
- Incentives. Reward schemes that pay more to an attacker than to an honest user.
Integrations
Every protocol you call is part of your attack surface. We check how your contracts behave when an integrated oracle is stale, a pool is drained, a bridge pauses, or a token blacklists your contract.
Types of DeFi protocol
| Protocol type | Where we spend the time |
|---|---|
| Lending and borrowing | Collateral pricing, liquidation, interest accrual, bad debt |
| AMMs and DEXs | Swap maths, fee accounting, router approvals, MEV exposure |
| Yield and vaults | Share accounting, strategy risk, first depositor attacks |
| Derivatives and perps | Funding, margin, oracle latency, settlement |
| Staking and restaking | Reward accounting, withdrawal queues, slashing paths |
The approval bug we caught live
In April 2023 HYDN monitoring caught an approval bug in SushiSwap’s RouteProcessor2 contract while it was being exploited. We worked with the Sushi team that night and rescued over $600,000 of user funds. Router approvals are now one of the first things we check in any DEX audit. Read the case study.
Frequently asked questions
How long does a DeFi audit take?
A standard DeFi protocol typically takes 2 to 4 weeks. Protocols with many integrations, custom maths or cross-chain components take longer.
Do you test economic attacks or just the code?
Both. Many of the largest DeFi losses came from code that did exactly what it was written to do, under market conditions the designers did not expect. We look for those conditions.
Which DeFi protocols has HYDN worked with?
Our clients include SushiSwap, Sablier, Revert Finance, StakeDAO, Clearpool, SpookySwap and Swapsicle, among others.
Published Updated