MantleCompactRiskVault_Suite__4_contracts_

Mantle Mainnet · scan depth full-report · generated 6/16/2026, 10:19:02 PM

Risk Score

100

Archon completed a read-only Mantle Mainnet audit of MantleCompactRiskVault_Suite__4_contracts_ and found 115 deterministic findings. The highest-priority issue is Weak Prng, with risk score 100/100 based on severity-weighted findings. The weakRandomPayout function derives randomness entirely from predictable, miner/miner-influenced values (block.timestamp, block.prevrandao, block.number, msg.sender, tx.origin). This allows miners or validators to manipulate the outcome, potentially draining the vault. Review the recommended fixes and run regression tests before deployment.

Findings

low: 46high: 13info: 38medium: 18critical: 0

Public validation

Challenge ledger

Anyone can challenge this artifact. Archon records the challenge in the database with a deterministic hash and references any existing report proof tx/hash. No new validation contract is implied.

No challenges recorded yet.

Proof Verification

Stored report hash

0x39e9ec40faa32a31c083f683448819aa52ead5f0b674bad5d7cc2e326b1d6439

Re-derived hash

0x39e9ec40faa32a31c083f683448819aa52ead5f0b674bad5d7cc2e326b1d6439

Metadata URI

ipfs://QmRBqGL1xgfegcs5zF22U4csCFLR3Gz1Rjq3wd6tJuTJLL

Result

Hash match + ERC-8004 on-chain attestation present

Mantlescan

ERC-8004 Reference

{
  "author": "0xBd88eAE165F8A00B1B33357Fb0880CD4fE5C5E70",
  "agentId": "97",
  "contract": "0xe7043e2ec95eF357FbBa3359BA2f1edb10cEAD2a",
  "loggedBy": "0xBd88eAE165F8A00B1B33357Fb0880CD4fE5C5E70",
  "mechanism": "archon-proof-registry",
  "reputation": {
    "tag2": "risk:100",
    "txHash": "0xbdf3143924f00579efa3e9251e01757567a1dc24d9d44b01208933ea69cdab15",
    "agentId": "97",
    "feedbackIndex": "16",
    "feedbackClient": "0x8cd94bc5Ce29ECDA7feDbc14D264873835284D79",
    "reputationRegistry": "0x8004BAa17C55a88189AE136b182e5fdA19dE9b63"
  }
}

Careful scope

Archon reports are risk intelligence with confidence scores and recommended fixes. They are not guarantees, certifications, or claims that a contract is safe.

Severity	Finding	Location	Confidence
high	Weak Prng The weakRandomPayout function derives randomness entirely from predictable, miner/miner-influenced values (block.timestamp, block.prevrandao, block.number, msg.sender, tx.origin). This allows miners or validators to manipulate the outcome, potentially draining the vault.	MantleCompactRiskVault_Suite__4_contracts_.sol:421	95%
high	Controlled Delegatecall The adminDelegateCall function allows the contract owner to perform arbitrary delegatecalls to any address. A compromised or malicious owner can execute any code in the context of the vault, potentially selfdestructing, stealing all tokens, or altering critical state.	MantleCompactRiskVault_Suite__4_contracts_.sol:483	98%
high	Encode Packed Collision The use of `abi.encodePacked` with multiple dynamic types (`string calldata payload` and `bytes calldata arbitraryData`) can lead to hash collisions, allowing an attacker to craft different input values that produce the same `messageHash`. This can be exploited to bypass the `!consumedMessages[messageHash]` check, enabling double-spend or replay attacks on cross-chain messages.	MantleCompactRiskVault_Suite__4_contracts_.sol:444	90%
high	Unchecked Transfer The `deposit` function uses `IERC20Like(token).transferFrom(...)` without checking the return value, which is required by the ERC20 standard (it returns a `bool`). Some tokens (e.g., USDT) return `false` instead of reverting on failure, leading to silent failures. Additionally, the accounting assumes the full `amount` was transferred, but if the token is a fee-on-transfer token, the actual received amount may be less than `amount`, causing the vault to credit more shares than it actually received, leading to potential fund loss or insolvency.	MantleCompactRiskVault_Suite__4_contracts_.sol:172	95%
high	Unchecked Transfer The `sweepByOrigin` function uses `tx.origin` for authorization, which can be tricked by malicious contracts calling the vault, allowing unauthorized asset sweeps if the owner interacts with a rogue contract. Additionally, the `transfer` call does not check its return value, potentially failing silently on non-standard tokens.	MantleCompactRiskVault_Suite__4_contracts_.sol:497	95%
high	Unchecked Transfer The `weakRandomPayout` function derives randomness from predictable block variables (`timestamp`, `prevrandao`, `number`, `msg.sender`, `tx.origin`), enabling miners/validators or MEV searchers to compute and influence the payout outcome in their favor. Additionally, any downstream `transfer` of tokens (implied by context) may be unchecked, compounding the risk.	MantleCompactRiskVault_Suite__4_contracts_.sol:421	85%
high	Unchecked Transfer The `liquidate` function does not check the return value of the `transferFrom` call when seizing the position's collateral. If the token transfer fails silently (e.g., a non-standard ERC20 that returns false instead of reverting), the contract will incorrectly assume that the collateral was successfully transferred, leading to an inconsistent state where the position is closed but no tokens were moved.	MantleCompactRiskVault_Suite__4_contracts_.sol:312	90%
high	Unchecked Transfer The `repay` function calls `transferFrom` without checking its return value. If the token transfer fails silently (e.g., due to insufficient balance, approval, or a non-reverting ERC20), the contract will still deduct the debt from the position, allowing a borrower to repay without actually transferring tokens.	MantleCompactRiskVault_Suite__4_contracts_.sol:297	90%
high	Unchecked Transfer The `withdraw` function performs an external token transfer before updating the position's state (amount and closed flag). This violates the checks-effects-interactions pattern and is vulnerable to reentrancy, allowing an attacker to drain funds or manipulate state.	MantleCompactRiskVault_Suite__4_contracts_.sol:236	95%
high	Unchecked Transfer The `borrow` function increases the debt state variable before calling an external token transfer. Although the external call occurs after the debt is updated, the token transfer is unchecked and could fail silently, leading to inaccurate debt accounting and potential fund loss if the token has transfer fees or reverts.	MantleCompactRiskVault_Suite__4_contracts_.sol:279	90%
high	Unchecked Transfer The withdrawWithHook function calls an arbitrary external hook contract (IHookLike) before updating the position's state. This allows the hook to re-enter the contract while the position still appears open and full, potentially draining funds multiple times or manipulating other state.	MantleCompactRiskVault_Suite__4_contracts_.sol:253	90%
high	Unchecked Transfer The claimReward function transfers tokens before updating the lastClaimAt timestamp. Because p.lastClaimAt is used in pendingReward calculation, an attacker can re-enter claimReward (directly or via a malicious token's transfer hook) and claim the same reward multiple times before the timestamp is updated.	MantleCompactRiskVault_Suite__4_contracts_.sol:219	85%
medium	Reentrancy No Eth The `withdraw` function performs an ERC-20 token transfer before updating the position state to `amount = 0` and `closed = true`. This creates a reentrancy window where a malicious ERC-20 token or an attacker with control over a legitimate token's callback could re-enter the contract before the state is updated, potentially draining the same position multiple times.	MantleCompactRiskVault_Suite__4_contracts_.sol:236	90%
medium	Reentrancy No Eth The `withdrawWithHook` function calls an arbitrary external hook contract before updating the position state. This allows a malicious hook or a reentrancy via the hook to manipulate state or re-enter the vault functions, potentially draining funds or causing inconsistent state.	MantleCompactRiskVault_Suite__4_contracts_.sol:253	95%
medium	Reentrancy No Eth The repay function makes an external call to transferFrom before updating the position's debt state, which could be exploited via reentrancy if the ERC20 token has a callback mechanism (e.g., ERC777 or a malicious token). The state update occurs after the external call, violating the checks-effects-interactions pattern.	MantleCompactRiskVault_Suite__4_contracts_.sol:297	75%
medium	Reentrancy No Eth The claimReward function performs a token transfer to the user before updating the lastClaimAt state, which could allow reentrancy if the token contract has a callback mechanism. An attacker might be able to repeatedly claim rewards before the timestamp is updated, draining the vault's reward pool.	MantleCompactRiskVault_Suite__4_contracts_.sol:219	70%
medium	Reentrancy No Eth Reentrancy No Eth was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:312-338. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:312	74%
medium	Tx Origin Tx Origin was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:497-503. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:497	74%
medium	Tx Origin Tx Origin was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:147-151. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:147	74%
medium	Unchecked Lowlevel Unchecked Lowlevel was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:444-467. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:444	74%
medium	Unused Return Unused Return was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:253-270. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:253	74%
medium	Unused Return Unused Return was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:348-356. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:348	74%
low	Events Access Events Access was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:153-156. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:153	74%
low	Events Maths Events Maths was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:142-145. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:142	74%
low	Missing Zero Check Missing Zero Check was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:113. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:113	74%
low	Missing Zero Check Missing Zero Check was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:483. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:483	74%
low	Missing Zero Check Missing Zero Check was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:158. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:158	74%
low	Missing Zero Check Missing Zero Check was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:162. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:162	74%
low	Missing Zero Check Missing Zero Check was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:153. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:153	74%
low	Missing Zero Check Missing Zero Check was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:147. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:147	74%
low	Missing Zero Check Missing Zero Check was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:469. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:469	74%
low	Calls Loop Calls Loop was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:236-251. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:236	74%
low	Reentrancy Benign Reentrancy Benign was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:172-209. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:172	74%
low	Reentrancy Events Reentrancy Events was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:279-295. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:279	74%
low	Reentrancy Events Reentrancy Events was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:219-234. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:219	74%
low	Reentrancy Events Reentrancy Events was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:444-467. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:444	74%
low	Reentrancy Events Reentrancy Events was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:236-251. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:236	74%
low	Reentrancy Events Reentrancy Events was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:253-270. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:253	74%
low	Reentrancy Events Reentrancy Events was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:469-481. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:469	74%
low	Reentrancy Events Reentrancy Events was detected from deterministic analysis at MantleCompactRiskVault_Suite__4_contracts_.sol:312-338. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleCompactRiskVault_Suite__4_contracts_.sol:312	74%