Full review · 2026-09
Review No. 3
20 Sep 2026 – 21 Sep 2026. What was examined, how, what was left out, and what the review found.
Disclosed
Scope
What was reviewed
- Commit
- Commit 36cf0e7614f863c89f24135298a90203e110071dPlus the HedgerPool 1.3.0 change, uncommitted at review time and since committed unchanged as 37d2381fbe0ed73bc28160fa46d335f6a73de265.
- Deployed state
- Base (chain 8453), pinned at block 51,571,192
- Toolchain
- forge 1.7.1 · solc 0.8.24 · via_ir, EVM shanghai
- Components
- Deployment verification · QuantillonVault and QEURO · HedgerPool · Staking, yield and fees · Oracles and execution pricing · Privileges and upgrade path · Deployment scripts and release process
Method
How
- AI models and tools
- Claude Fable 5.1 (Anthropic, AI model) · GPT-6 Astra (OpenAI, AI model)
- Method version
- v1
- Component-by-component source review, with every suspected issue recorded in a hypothesis ledger, including the ones that were ruled out.
- Findings graded by evidence level: verified on chain or by a proof-of-concept test, reproduced by a proof-of-concept test, or source reading only.
- Deployment verification: implementation addresses read from ERC-1967 slots at a pinned block, and live bytecode compared with a build of the reviewed source.
- Static analysis with Slither across the full detector set, triaged by hand.
- Stateful invariant fuzzing campaign with Foundry.
- Recurrence check against the findings of earlier reviews.
- Full existing test suite run as a baseline before the review.
Limits
Not covered
- Symbolic execution (Mythril) was not run in this cycle.
- Stateful invariant campaigns covered the vault and the hedger pool only.
- Off-chain services were examined only at their trust boundary with the contracts.
- Live bytecode could not be matched to the reviewed build for UserPool, YieldShift and ExecutionPricing; these three were reviewed at source level only.
- Third-party contracts the protocol integrates with were not reviewed beyond their interfaces.
Deployed code
Is what is live what was reviewed?
Each row compares the implementation reviewed in this cycle with the one live today.
Results
Findings
Cycle-specific disclosure decision
On 1 Oct 2026, the protocol owner authorized a 7-day post-deployment cooldown for this review. The protocol owner authorized publication after remediation and post-deployment validation.
| Severity | Found | Resolved |
|---|---|---|
| Critical | 0 | 0 |
| High | 1 | 1 |
| Medium | 6 | 6 |
| Low | 14 | 14 |
| Informational | 0 | 0 |
| Ref | Severity | Summary | Resolution |
|---|---|---|---|
| QSR-2026-09-01 | High | SlippageStorage / HyperliquidEurUsdOracle. Mid-price writes honour the minimum update interval; a cumulative drift bound and an independent Chainlink EUR/USD cross-check gate the market price. | Mitigated in SlippageStorage 1.0.3, HyperliquidEurUsdOracle 1.0.5, ChainlinkOracle 1.0.5 · live 23 Sep 2026The shared publisher identity is unchanged and documented as an accepted operational-scope risk. |
| QSR-2026-09-02 | Medium | SecureUpgradeable (all core proxies). Repointing a core proxy’s timelock now itself requires the timelock, and core DEFAULT_ADMIN_ROLE was transferred to the TimelockController. | Fixed in QuantillonVault 1.3.4, QEUROToken 1.0.9, QTIToken 1.0.5, UserPool 1.0.6, HedgerPool 1.4.1, YieldShift 1.1.1, stQEUROFactory 1.0.4, stQEUROToken 1.2.4 · live 23 Sep 2026 |
| QSR-2026-09-03 | Medium | ExecutionPricing. Execution capacity is computed per direction, with a separate gross cap applied to mints only, so sell-side volume cannot consume redemption capacity. | Fixed in ExecutionPricing 1.3.2 · Commit 6c2d547cacbbfca41035ffc114aff17632fbbc95 · live 22 Sep 2026 |
| QSR-2026-09-04 | Medium | ExecutionPricing / QuantillonVault. Redemptions proceed at a haircut when the book is stale or the router is on fallback; governance can reconcile exposure during a pause to replace the module. | Fixed in ExecutionPricing 1.3.2 · Commit 6c2d547cacbbfca41035ffc114aff17632fbbc95 · live 22 Sep 2026 |
| QSR-2026-09-05 | Medium | stQEUROToken. Deposits and mints revert when the share price would leave one-to-one; the empty-series residual sweep is capped at dust, remainder to the treasury. | Fixed in stQEUROToken 1.2.4 · Commit 6c2d547cacbbfca41035ffc114aff17632fbbc95 · live 22 Sep 2026 |
| QSR-2026-09-06 | Medium | stQEUROToken. Yield vests linearly over a governance-set period (24 hours by default) instead of accruing in full at the next update. | Fixed in stQEUROToken 1.2.4 · Commit 6c2d547cacbbfca41035ffc114aff17632fbbc95 · live 22 Sep 2026 |
| QSR-2026-09-07 | Medium | FeeCollector. ETH fee distribution no longer rejects recipients that have code, such as Safes and delegated accounts. | Mitigated in FeeCollector 1.0.3 · Commit 6452d9fe89743ed71f6fc854bd690a3a5cc6fff7 · live 23 Sep 2026Recipient assignments are unchanged and documented as an accepted operational-scope risk. |
| QSR-2026-09-08 | Low | Release tooling. Deployment records are written only for activated implementations, and CI checks deployed versions against the source. | Fixed in release of 23 Sep 2026 · live 23 Sep 2026 |
| QSR-2026-09-09 | Low | HedgerPool. Interest rewards are checkpointed before every change of exposure. | Fixed in HedgerPool 1.4.1 · Commit 6452d9fe89743ed71f6fc854bd690a3a5cc6fff7 · live 23 Sep 2026 |
| QSR-2026-09-10 | Low | HedgerPool. Configuration rejects a minimum margin ratio that is incompatible with the maximum leverage while a position is active. | Fixed in HedgerPool 1.4.1 · Commit 6452d9fe89743ed71f6fc854bd690a3a5cc6fff7 · live 23 Sep 2026 |
| QSR-2026-09-11 | Low | HyperliquidEurUsdOracle. A guarded emergency re-seed of the deviation baseline exists, conditioned on the independent reference check passing. | Fixed in HyperliquidEurUsdOracle 1.0.5 · Commit 6c2d547cacbbfca41035ffc114aff17632fbbc95 · live 22 Sep 2026 |
| QSR-2026-09-12 | Low | QuantillonVault. Yield crediting is gated on the vault’s own collateralisation floor rather than on the mint floor. | Fixed in QuantillonVault 1.3.4 · Commit 6c2d547cacbbfca41035ffc114aff17632fbbc95 · live 22 Sep 2026 |
| QSR-2026-09-13 | Low | MetaMorphoStakingVaultAdapter / QuantillonVault. External-vault withdrawals top up sub-dust shortfalls, and a loss of external principal can be written down and reflected in accounted collateral. | Fixed in MetaMorphoStakingVaultAdapter 2.1.1, QuantillonVault 1.3.4 · live 23 Sep 2026 |
| QSR-2026-09-14 | Low | QuantillonVault. Changing a staking-vault pointer requires the replacement to hold at least the tracked principal; deactivating with principal deployed reverts. | Fixed in QuantillonVault 1.3.4, MetaMorphoStakingVaultAdapter 2.1.1 · live 23 Sep 2026 |
| QSR-2026-09-15 | Low | YieldShift. Permissionless yield-distribution updates are rate-limited by a minimum interval, and the inactive holding-period discount was removed. | Fixed in YieldShift 1.1.1 · Commit 6452d9fe89743ed71f6fc854bd690a3a5cc6fff7 · live 23 Sep 2026 |
| QSR-2026-09-16 | Low | Upgrade gates. The version gate hashes each unit’s full import closure and the storage-layout gate diffs nested struct members. | Fixed in release of 23 Sep 2026 · live 23 Sep 2026 |
| QSR-2026-09-17 | Low | HedgerPool / QuantillonVault. Runtime headroom under the EIP-170 limit was recovered on HedgerPool; the one-shot legacy correction remains as an inert, already-applied entry point. | Mitigated in HedgerPool 1.4.1, QuantillonVault 1.3.4 · live 23 Sep 2026Live runtime sizes on 23 Sep 2026: HedgerPool 24,092 bytes (484 free), QuantillonVault 24,419 bytes (157 free). |
| QSR-2026-09-18 | Low | ExecutionPricing / HyperliquidEurUsdOracle. Execution risk limits now hold a 10 bps buffer and a 60-second book age, and the market price is cross-checked against Chainlink. | Mitigated in ExecutionPricing 1.3.2, HyperliquidEurUsdOracle 1.0.5 · Commit 6c2d547cacbbfca41035ffc114aff17632fbbc95 · live 22 Sep 2026Mint and redemption fees remain at zero; the 900-second price staleness bound is unchanged but bounded by the reference check. |
| QSR-2026-09-19 | Low | Release tooling. Release tooling binds linked libraries and implementations by runtime code hash before linking and recording. | Fixed in release of 23 Sep 2026 · live 23 Sep 2026 |
| QSR-2026-09-20 | Low | Release tooling. Version records are written by a fail-closed step at the end of every release rather than by an optional manual step. | Fixed in release of 23 Sep 2026 · live 23 Sep 2026 |
| QSR-2026-09-21 | Low | Deployment scripts. Deployment and verification scripts sign through Foundry keystores and reject raw keys on the command line. | Fixed in release tooling, 22 Sep 2026 · live 22 Sep 2026Source commit 6ea4d52e. |