Skip to main content

Security

Not professionally audited

IndexPad is testnet software. It has been through intensive internal multi-agent review (below), but no professional third-party audit. Do not use it with real funds until the mainnet gates are met.

Design-level guarantees​

The most important security properties are structural, not patched-in:

  • No trusted operator. The fee split executes inside every swap in the IndexFeeHook, in the same PoolManager lock. There is no keeper, no batch job, and no privileged "convert" — nothing whose honesty or liveness holders depend on. The old FeeSwapEngine / IndexDividends / dividend path is deleted.
  • Fixed, never-mintable supply. 1,000,000 tokens minted once; there is no mint function anywhere. Bonds sell treasury inventory rather than minting, so supply is a hard invariant that can only decrease via redemption burns.
  • Immutable token economics. The basket and the 3-way fee split (rfvShareBps / buybackShareBps) are fixed at launch — the creator cannot rug via parameter changes. There is no blacklist and no fee-exemption list; fees are a property of the pool, not the token.
  • Unpausable exits. The guardian pause blocks new launches only. Swaps, IndexTreasury.redeem(), and bond claim() can never be paused or gated.
  • Oracle-free floor. Redemption is pure pro-rata arithmetic over the treasury's raw balances — it works even if every price feed is down, and rounding always favors the remaining holders. NAV/backing displays use Chainlink; the payout never does.
  • Per-asset isolation. A single frozen/paused RWA can neither brick a trade (the hook's basket leg is try/catch-isolated, its USDG falling through to the reserve) nor brick an exit (the redeem payout leg is isolated, its share staying as backing).
  • Vault-style hygiene throughout: checks-effects-interactions, nonReentrant on redeem/bond/claim, received-amount (net) measurement on deposits and swaps, and hard caps (basket ≤ 16) bounding all loops.

Bond-market safety (built, enabled later)​

Bonds sell treasury inventory at a discount, so their whole risk surface is not selling below true value:

  • Floored at guarded backing. The sale price is max(marketTWAP × (1 − discount), backingPerToken), and the backing leg uses a fail-closed reader (backingPerTokenUsdgGuarded) that reverts on a stale/missing feed or a down sequencer. A mispriced-low floor can never let a bond sell below true backing.
  • Manipulation-resistant market price. The market leg is a TWAP over ≥ 30 min recorded by the hook, not an instantaneous spot; a thin or freshly-launched pool prices off the backing floor instead.
  • Minimum vesting (1h). Breaks the atomic crash-spot → bond → claim sequence, forcing any manipulator to carry price-recovery risk across time.
  • Strictly accretive. The deposit raises NAV while supply is untouched, so backing-per-token rises with every bond. Confirmed numerically in the adversarial audit.

Internal audits​

The protocol has been through repeated multi-agent adversarial audits as its architecture evolved (multiple specialized finders + independent skeptic verifiers, across several rounds). Two are load-bearing for the current design:

  • Fixed-supply + treasury-inventory bonds + 3-way split (the pivot to the current model): a 5-lens × 3-skeptic pass at high effort returned 0 confirmed findings, with all seven core invariants numerically verified — fixed supply, protocol-always-10% (in both buyback-success and reroute cases), inventory-only bonds, strictly-accretive, per-asset isolation, one-shot depository latch, and ETH-nets-to-zero.
  • Inline-split hook rewrite (USDG single-sided + inline no-keeper fee split): validated by the full unit suite plus an on-chain LaunchTradeE2E proving the split grows reserve + buyback + basket every swap. An adversarial audit of the rewritten hook's delta accounting is the tracked follow-up before mainnet.

Earlier rounds eliminated whole classes of bug by construction: removing the keeper killed the keeper-trust and snapshot-liveness surface; removing the on-chain dividend accumulator killed its overflow-DoS and griefable-maturity findings; the fixed-supply pivot removed every mint path.

Full details in AUDIT.md.

Known limitations & accepted residuals​

  • Basket leg routing. The inline split buys stocks on hookless USDG/stock V4 reserve pools. On mainnet, Robinhood tokenized equities trade via RFQ/0x, not necessarily AMM pools — this routing must be confirmed (or adapted) before mainnet.
  • Basket assets must be vanilla ERC-20s (no fee-on-transfer/rebasing) — enforced socially via the governance allow-list; the official Robinhood tokenized equities qualify (standard ERC-20, no pause/freeze/blocklist per Robinhood's docs). Deposits/swaps are net-measured to absorb the FoT case regardless.
  • ERC-8056 Scaled UI Amount. If a basket stock's uiMultiplier() folds dividends/splits into balanceOf, confirm balanceOf already reflects it before enabling bonding on such a basket (guarded NAV values raw balanceOf). Redemption is unaffected (pro-rata of raw balances).
  • Custom router. In-app trading uses the purpose-built V4SwapRouter because Robinhood Chain ships a forked Universal Router; the real UR should be confirmed for mainnet.
  • Legacy registry fields (keeper, challengeWindow, swapEngine, distributionEnabled, ethUsdFeed) are vestigial in the inline model and slated for deletion before mainnet.

Mainnet gates​

All of the following before any 4663 deployment:

  1. Tokenized-equity custody spike (verify an arbitrary contract can hold/transfer the real stock tokens).
  2. Professional audit of the high-severity areas — especially the hook's delta accounting.
  3. US-person geo-gating + legal review for stock baskets.
  4. Confirm mainnet stock-buy routing (RFQ/0x vs AMM reserve pools) and the real Universal Router vs the custom router.

Reporting​

Found something? Open a private security advisory on GitHub or contact the team — please don't open public issues for vulnerabilities.