
Loading...
Loading
Loading...
LoadingLoading audit report...

WalletGuard.ai, powered by Gestalt Labs
Forge fork-validation ran but no findings met the threshold for PoC inclusion. See the per-finding "Forge validated" badges in the report below for individual results.
The analyzed contract is the Wildcat Protocol, a permissioned fixed-rate lending market system with hooks-based access control, role provider credential management, and factory-driven market deployment. The analysis identified 0 critical, 2 high, 7 medium, 10 low, and 8 informational findings across 27 total reported items. The single most dangerous pattern is the missing market registration check on the hooks contract's onQueueWithdrawal function, which allows any caller to manipulate lender credential state via attacker-controlled role providers. Overall, the contract carries moderate-to-high risk; several logic errors and access control gaps in the hooks subsystem require remediation before production deployment, particularly for lender-adverse scenarios in fixed-term markets.
A critical gate check is missing from the onQueueWithdrawal function in AccessControlHooks. Any external actor can call this function directly, impersonating a market, and supply crafted data that causes the hooks contract to make an external call to an attacker-chosen address. This can grant or revoke lender credentials for arbitrary accounts, allowing unauthorized lenders to gain deposit access or legitimate lenders to be locked out.
Once a role provider is removed from the system, it should lose all authority. However, the revokeRole function only checks that the caller matches the address that last granted a credential, not whether that address is still an active provider. A removed provider can therefore continue revoking access for every lender it previously approved, silently denying those lenders the ability to deposit or withdraw.
Fixed-term loans are marketed to lenders as having a guaranteed lock-up period. However, the borrower can call setFixedTermEndTime with a value of zero or any past date, immediately unlocking withdrawals ahead of schedule. While this technically benefits lenders by allowing early exit, it breaks the fixed-term guarantee, may violate agreed terms, and could be used to manipulate market liquidity dynamics.
3 centralization points identified
The function is permissionless but can only succeed once and only registers the factory itself. The risk is front-running the deployer, but the arch controller enforces single registration, limiting actual harm.
registerWithArchController()The borrower has a permanent, non-removable ability to grant credentials directly. This is a design-level centralization property lenders should be aware of, not an external exploit.
constructor()This is a documented design property of fixed-term lending: the borrower controls the term. Lenders accept this constraint at deposit time. It is a centralization note about borrower power rather than an implementation bug.
onQueueWithdrawal()An attacker calls onQueueWithdrawal on AccessControlHooks directly (bypassing the missing isHooked check), supplying crafted hooksData that encodes an attacker-controlled provider address. The hooks contract calls validateCredential on the attacker-controlled provider (Finding 5). During that external call, the lender status has not yet been written back to storage (Finding 2, CEI violation in _tryValidateCredential). The attacker-controlled provider re-enters onDeposit or onQueueWithdrawal on the hooks contract to observe or modify stale lender state, granting credentials to unauthorized accounts or revoking credentials for legitimate lenders before the original write completes.
A role provider is removed via removeRoleProvider. Because revokeRole does not check whether the caller is still an active provider (Finding 7, confirmed by Finding 13 as a duplicate path), the removed provider can revoke all credentials it previously issued. If the CEI violation in validateCredential (Finding 2) was previously exploited to issue inconsistent credential state, the removed provider can also selectively revoke only the legitimate lenders, compounding the denial-of-service impact.
| Agent | Status | Findings | Severity | Confidence | Duration | Coverage |
|---|---|---|---|---|---|---|
| reentrancy | success | 4 | 2M2L | 68% | 56.4s | Cross-function reentrancy in WildcatMarket deposit/withdraw/borrow cycle, ERC-777 callback reentrancy via safeTransferFrom in deposit, repay, collectFees, borrow, Callback-based reentrancy via validateCredential external call in AccessControlHooks and FixedTermLoanHooks, ReentrancyGuard implementation using transient storage (tstore/tload), CEI pattern compliance in _depositUpTo, repay, borrow, closeMarket, collectFees, Cross-contract reentrancy between market and hooks contracts, Read-only reentrancy via view functions (currentState, balanceOf, scaleFactor), Hook call ordering relative to state updates, Flash loan callback patterns in repayAndProcessUnpaidWithdrawalBatches, ERC-1155 batch transfer callbacks - not present in this contract, HooksFactory nonReentrant protection on deployMarket and deployHooksInstance, WildcatSanctionsEscrow releaseEscrow reentrancy |
| access control | success | 7 | 1H2M2L | 79% | 1.3m | Access control on all external functions in AccessControlHooks and FixedTermLoanHooks, Role provider management (add, remove, update) for both hooks contracts, Credential validation logic (_tryValidateAccess, _tryGetCredential, _tryValidateCredential), Hooks dispatch functions (onDeposit, onQueueWithdrawal, onTransfer, etc.), HooksFactory deployment functions and access controls, Market deployment and parameter setting in WildcatMarket and WildcatMarketConfig, Ownership patterns in WildcatArchController (Ownable via Solady), Authentication of market functions (onlyBorrower, factory-only checks), Reentrancy protection using transient storage ReentrancyGuard, Signature authentication (none present - no EIP-712 or ecrecover usage), HooksConfig library for calldata construction to hook contracts, WildcatSanctionsEscrow and WildcatSanctionsSentinel for escrow logic, TransientBytesArray for temporary market parameter storage, SphereXProtectedRegisteredBase for operator access control |
| economic | success | 6 | 3L | 73% | 1.5m | Flash loan attack vectors on deposit/withdrawal accounting, Oracle manipulation (no price oracles used - not applicable), Reentrancy across all market functions with transient storage guard, Access control on borrower-only and provider-only functions, Hooks calldata construction in LibHooksConfig for all hook types, Interest rate and fee calculations in FeeMath, Withdrawal batch processing and FIFO queue logic, Role provider credential grant/revoke logic, Fixed term loan end time validation, HooksFactory deployment of hooks instances and markets, Sanctions escrow creation and release logic, Governance attacks (not applicable - no governance tokens), MEV exposure on deposits/withdrawals, Integer overflow/underflow in assembly blocks, State machine transitions (market open/closed), Known lender status tracking across deposit/transfer/withdrawal hooks, Credential expiry and refresh logic in access control hooks, Assembly-level calldata encoding for hook dispatch, Transient storage usage for market parameters during deployment, Scale factor and normalized amount calculations |
| logic validation | success | 6 | 1M2L | 71% | 1.2m | Input validation and parameter bounds in AccessControlHooks, FixedTermLoanHooks, HooksFactory, MarketConstraintHooks, Arithmetic safety in FeeMath, MathUtils, MarketState calculations, State machine integrity for market lifecycle (open/closed), withdrawal batches, fixed term locks, Role provider management and credential grant/revoke logic, Hook calldata construction in LibHooksConfig, Reentrancy protection via transient storage ReentrancyGuard, Market deployment salt validation and origination fee handling, Protocol fee update propagation via pushProtocolFeeBipsUpdates, Temporary reserve ratio calculation in MarketConstraintHooks, LenderStatus credential expiry and refresh logic, WildcatSanctionsEscrow and sanctions sentinel logic, ERC20 transfer/deposit/withdrawal flows in WildcatMarket, Encoding/hash collision risks in provider credential handling |
| code quality | success | 9 | 71% | 1.5m | ERC-20 standard compliance (transfer, transferFrom, approve, allowance, balanceOf, totalSupply, events), Access control on all privileged functions (onlyBorrower, onlyArchControllerOwner), Reentrancy protection via transient storage ReentrancyGuard, Role provider credential grant/revoke/refresh logic, FixedTermLoanHooks fixed term enforcement, HooksFactory market and hooks instance deployment, WildcatMarket deposit/withdraw/borrow/repay/closeMarket flows, CEI pattern violations, Unchecked downcasts and SafeCast usage, SphereX engine integration, Sanctions/escrow logic, Transient storage usage for market parameters, Create2 address computation, Assembly calldata manipulation in hooks dispatch, Integer overflow/underflow in interest calculations, Pull provider index management and removal, Known vulnerability patterns: off-by-one in loops, unchecked downcast truncation | |
| compiler bugs | success | 3 | 58% | 48.8s | AccessControlHooks credential validation logic (grantRole, revokeRole, blockFromDeposits, _grantRole), FixedTermLoanHooks fixed term enforcement and withdrawal access control, HooksFactory deployment flow, salt validation, origination fee handling, WildcatMarket deposit/withdraw/borrow/repay/closeMarket state transitions, WildcatMarketBase reentrancy guard (transient storage), sanction checks, WildcatMarketWithdrawals withdrawal batch processing and execution, LibHooksConfig hook calldata construction for all hook types, RoleProvider pull-provider index management and removal, ReentrancyGuard transient storage implementation, WildcatSanctionsSentinel escrow creation and sanction override, Compiler bug patterns: ABIEncoderV2 storage arrays (pragma >=0.8.x, not affected), signed int array bugs (not applicable), constructor naming bugs (not applicable for 0.8.x) | |
| assembly safety | success | 5 | 3L | 85% | 58.3s | Full codepoint scan of all source files for non-ASCII characters, RTLO (U+202E), zero-width joiners/spaces, and Cyrillic homoglyphs in identifiers - none found except decorative ASCII art in comments, All assembly{} blocks examined for: hardcoded slot access, return vs leave confusion, selfdestruct paths, reversed shl/shr arguments, unchecked delegatecall success, free memory pointer restoration, out-of-bounds calldataload, HooksConfig.sol onBorrow/onRepay size constant copy-paste issue, HooksConfig.sol onSetAnnualInterestAndReserveRatioBips returndatasize check ordering, AccessControlHooks and FixedTermLoanHooks credential validation logic, ReentrancyGuard tstore/tload transient storage implementation, HooksFactory._deployHooksInstance assembly create block, LibStoredInitCode assembly deployment helpers, WildcatMarketBase state packing/unpacking assembly in _writeState and constructor, SphereXProtectedRegisteredBase engine interaction and storage slot patterns, WildcatSanctionsEscrow and WildcatSanctionsSentinel create2 patterns, FixedTermLoanHooks fixed term withdrawal restriction logic, TransientBytesArray tstore/tload encoding/decoding, JsonUtil assembly in create() function (sstore/sload to named slot pattern) |
| l2 specific | success | 8 | 1M3L | 67% | 1.6m | AccessControlHooks: Role provider management, credential granting/revoking, access control hooks (onDeposit, onTransfer, onQueueWithdrawal), FixedTermLoanHooks: Fixed term end time validation, withdrawal restrictions, role provider management, HooksFactory: Market deployment, hooks instance deployment, fee management, salt validation, WildcatMarket: Deposit, borrow, repay, closeMarket, rescueTokens functions, WildcatMarketBase: State management, sanction checking, withdrawal batch processing, WildcatMarketConfig: Access control for setAnnualInterest, setMaxTotalSupply, setProtocolFeeBips, nukeFromOrbit, WildcatMarketToken: Transfer, approve, transferFrom with hooks, WildcatMarketWithdrawals: queueWithdrawal, executeWithdrawal, repayAndProcessUnpaidWithdrawalBatches, ReentrancyGuard: Transient storage reentrancy guard implementation, HooksConfig: All hook dispatch functions including onBorrow, onRepay, onDeposit, onTransfer, MarketConstraintHooks: Parameter validation, temporary reserve ratio logic, WildcatSanctionsSentinel: Escrow creation, sanction override management, WildcatSanctionsEscrow: Escrow release logic, LibStoredInitCode: CREATE2 deployment helpers, TransientBytesArray: Transient storage encoding/decoding, LenderStatus: Credential management, RoleProvider: Encoding/decoding, TTL calculations, Cross-function reentrancy via hooks callbacks, Integer overflow/underflow in MathUtils and SafeCastLib, Assembly-level memory safety in hook dispatchers |
This automated audit has inherent limitations. The following areas are not covered.
This report is an automated point-in-time assessment and does not guarantee protection against all possible attacks. It does not cover off-chain components, economic modeling, or business logic correctness unless explicitly noted. Changes to the contract after the audit commit are not reviewed. This is not financial or legal advice. WalletGuard, powered by Gestalt Labs, provides this analysis as-is with no warranty of completeness.
[](https://walletguard.ai/audit/70131cbe-94f8-4fb4-882e-83eda794ede3)
<a href="https://walletguard.ai/audit/70131cbe-94f8-4fb4-882e-83eda794ede3"> <img src="https://walletguard.ai/api/badge/70131cbe-94f8-4fb4-882e-83eda794ede3" alt="WalletGuard Audit Badge" /> </a>