Skip to content
QuantillonSecurity
Navigation menu
Open app

Full review · 2026-09-30

Review No. 4

30 Sep 2026. What was examined, how, what was left out, and what the review found.

Disclosed

Scope

What was reviewed

Repository
github.com/Quantillon-Labs/smart-contracts
Commit
Commit 99b07596382536430815378b783a8835adf10fbcActive production implementations and service trust boundaries were reviewed at finalized Base block 51989742.
Deployed state
Base (chain 8453), pinned at block 51,989,742
Toolchain
forge 1.7.1 · solc 0.8.24 · via_ir, EVM shanghai
Components
Production deployment and bytecode correspondence · Vault, collateral strategy and QEURO · Execution pricing and hedging synchronization · Staking, yield distribution and factory registry · Oracle routing and market-price publication · Privileges, upgrades and migration authority · Production service trust boundaries

Method

How

AI models and tools
GPT-6 (OpenAI, AI model) — Primary review with three parallel specialist passes · Codex Security (OpenAI, review tool) — Independent repository security scan
Method version
v2
  • Threat-model-led source review of active production paths, with confirmed, rejected and unresolved hypotheses retained in the private record.
  • Deployment verification at pinned finalized blocks, including implementation slots, roles, risk settings and a final drift comparison.
  • Runtime bytecode reproduction for active implementations and linked libraries using recorded compiler settings and immutable values.
  • Foundry baseline, invariant and pinned-fork tests, including focused proof-of-concept tests for validated findings.
  • Static analysis of critical contracts and isolated tests of production services that can write protocol state.

Limits

Not covered

  • The review was partial at whole-repository file level and prioritized the active production-critical dependency graph.
  • External MetaMorpho governance and implementation, Hyperliquid account custody and the remote watchdog host were outside the available source.
  • The first production harvest after the current vault activation had not occurred by the final snapshot.
  • Whole-project Slither analysis was limited by tool compatibility; targeted critical-contract analysis completed.
  • Exact source correspondence for the inactive Stork oracle remains unresolved.

Deployed code

Is what is live what was reviewed?

Each row compares the implementation reviewed in this cycle with the one live today.

Contracts reviewed in cycle 2026-09-30 against the live deployment
ContractOn-chain versionReviewed versionImplementationStatusReview
AdminFunctionsLibrary1.0.11.0.1Address 0x3a2e247279238CA83c695B77dF680efAb6739097 on the block explorerReviewed at source only2026-09-30
ChainlinkOracle1.0.51.0.5Address 0x0c5aE6393E0010610E5a167E009DB2A61Def26BA on the block explorerReviewed · live bytecode matched2026-09-30
ExecutionPricing1.3.31.3.2Address 0x4338c6C9A912d51487cc0bf3b20162fdb25eFc03 on the block explorerUpgraded for a disclosed fix2026-09-30
ExecutionPricingLibrary1.1.11.1.1Address 0x21049b609d283fC50D3C5E0F87F8A3f40B0c5125 on the block explorerReviewed at source only2026-09-30
FeeCollector1.0.31.0.3Address 0x0B9A1DcbE1D469e2c42809a6adDb2DA571613b49 on the block explorerReviewed · live bytecode matched2026-09-30
HedgerPool1.4.11.4.1Address 0xEFc876ebC390F11c45D82b3e01258479CAf5FA51 on the block explorerReviewed · live bytecode matched2026-09-30
HedgerPoolAccountingLibrary1.3.01.3.0Address 0xbD997edec6C7963FDC218979B6678A463B739968 on the block explorerReviewed at source only2026-09-30
HedgerPoolLogicLibrary1.0.21.0.2Address 0x5483e73a4214F1D4c751cbd429dFb0DDFdbF2574 on the block explorerReviewed · live bytecode matched2026-09-30
HedgerPoolMigrationLibrary1.0.11.0.1Address 0x4fD35f9E5d1881Bfd741D9838DeAfDf6FB68007b on the block explorerReviewed at source only2026-09-30
HedgerPoolRedeemMathLibrary1.0.21.0.2Address 0x74924303FF6cBCC563BBFD9543103705C6B1A5bf on the block explorerReviewed · live bytecode matched2026-09-30
HyperliquidEurUsdOracle1.0.61.0.6Address 0xd1fbdfc4a755b59f47fdb50e3f560d50eee92c84 on the block explorerReviewed · live bytecode matched2026-09-30
MetaMorphoAdapterMigration1.0.01.0.0Address 0x248746CaF445a83Fd5351E9caf9e3661F3efCd7C on the block explorerReviewed at source only2026-09-30
MetaMorphoStakingVaultAdapter2.1.12.1.1Address 0x4c9B8b09214d37D5310b8E6768cF28E0dDcEDC30 on the block explorerReviewed at source only2026-09-30
OracleRouter1.1.21.1.2Address 0x547911c522cc02B5ce5A6403492d84b4F6c2b43b on the block explorerReviewed · live bytecode matched2026-09-30
PublicationBatcher1.0.01.0.0Address 0x0E7a3df68D527249fB3A2e66dC307ed1F119172d on the block explorerOther upgrade since review2026-09-30
QEUROToken1.0.91.0.9Address 0x8F4FEC2ebf7dDaB9A66465CC59d1566A9B0CD3B9 on the block explorerReviewed · live bytecode matched2026-09-30
QTITokenGovernanceLibrary1.0.11.0.1Address 0x1612218e4c1f548f7017a559221D7e0AE391260A on the block explorerReviewed · live bytecode matched2026-09-30
QuantillonVault1.5.01.5.0Address 0x4d1014C50Cb3AAfB5D45AECd5d47e05CFC5e5290 on the block explorerReviewed · live bytecode matched2026-09-30
ReportPublicationBatcher1.0.01.0.0Address 0x2efA498B9Fa9903A371A9fbE561555AD10589EeA on the block explorerOther upgrade since review2026-09-30
SecureUpgradeLibrary1.0.11.0.1Address 0x88eC9B417bd2e945945A535f145Fc99045C2a0fE on the block explorerReviewed at source only2026-09-30
SlippageStorage1.0.31.0.3Address 0xc21711cC8340d2Cd2Dbc059F039f753a0e478d05 on the block explorerReviewed · live bytecode matched2026-09-30
StakingYieldLibrary1.5.01.5.0Address 0x5dc57a0ba352E357afEbF9386fc3520CAD686058 on the block explorerReviewed · live bytecode matched2026-09-30
stQEUROFactory1.0.51.0.4Address 0x5DA141A467B1B8234Ed736327139C0057DCF4Cf2 on the block explorerUpgraded for a disclosed fix2026-09-30
stQEUROToken1.2.51.2.5Address 0x7EBA1D23Fb33D99b9Fe2f74Dab16D7554b794Fe5 on the block explorerReviewed at source only2026-09-30
TimeProviderUnavailable0.0.0-unversionedAddress 0x520236487CBD0a6958B4EefC7853cd7C3F5C56E7 on the block explorerReviewed at source only2026-09-30
TreasuryRecoveryLibrary1.0.11.0.1Address 0x508AE6807E85CAE22B8F834124615B2BDEDE7B3D on the block explorerReviewed at source only2026-09-30
UserPool1.0.71.0.6Address 0x0C5e613f996d94efe1Ec3e2e7a7432ff7554a444 on the block explorerUpgraded for a disclosed fix2026-09-30
UserPoolStakingLibrary1.0.11.0.1Address 0x1a39B55c5aF624809071b75d9F90689E9b24eE7f on the block explorerReviewed · live bytecode matched2026-09-30
YieldShift1.1.11.1.1Address 0x7e08d3E01B65d026311331C8431162cE5402347c on the block explorerReviewed · live bytecode matched2026-09-30
YieldShiftCalculationLibrary1.0.31.0.3Address 0x2d3639C5876B60A8899Db9Dc566d3Ec4A761d3f1 on the block explorerReviewed · live bytecode matched2026-09-30
YieldShiftOptimizationLibrary1.0.11.0.1Address 0xBe840BD8851de0CE7E32D718c4e4Fec9A1f0df50 on the block explorerReviewed · live bytecode matched2026-09-30

Results

Findings

Findings by severity
SeverityFoundResolved
Critical00
High00
Medium11
Low22
Informational00
Disclosed findings
RefSeveritySummaryResolution
QSR-2026-09-22MediumExecutionPricing / QuantillonVault. Degraded redemption fallback is bounded by a dedicated exposure budget.Fixed in ExecutionPricing 1.3.3 · Commit 31ed3d8c962cb89fd54d7551659b469824e42499 · live 1 Oct 2026A dedicated degraded-settlement budget now bounds fallback exposure.
QSR-2026-09-23LowstQEUROFactory. Vault name uniqueness is based on the full supplied name.Fixed in stQEUROFactory 1.0.5 · Commit 31ed3d8c962cb89fd54d7551659b469824e42499 · live 1 Oct 2026Name uniqueness now hashes the supplied content and preserves the existing registered name.
QSR-2026-09-24LowUserPool. Administrative token recovery preserves assets reserved for recorded UserPool claims.Fixed in UserPool 1.0.7 · Commit 31ed3d8c962cb89fd54d7551659b469824e42499 · live 1 Oct 2026Recovery now preserves recorded liabilities for configured assets.