Security
Lynxify smart contracts were independently audited by yAudit in July 2026. The full report is live on yAudit.
Audit partner
LYNX Token Contracts — audited by fedebianu and devtooligan
yAudit reviewed the Hedera vault, HTS bridge, strategies, keeper workflows, governance, and migration paths. The main risks were migration sequencing, permissionless keeper DEX paths, asset valuation and loss recognition, and HTS share accounting. Every reported issue was remediated; developer responses in the report mark all findings Fixed.
Audit coverage
17 production contracts (~3,049 lines) reviewed over 4 days. Libraries and interfaces in the same tree were included where they affect accounting, HTS, or keeper flows.
| Scope | Contracts | Auditor | Type | Status | Date | Report |
|---|---|---|---|---|---|---|
| LYNX Vault & HTS Bridge | LynxVault, LynxHTSBridge | yAudit | Smart Contract Audit | Complete | July 2026 | yAudit |
| Strategy Manager | StrategyManager | yAudit | Smart Contract Audit | Complete | July 2026 | yAudit |
| Liquidity Pool & Router | SaucerSwapLiquidityStrategy, LynxLpAllocator, LynxKeeperRouter | yAudit | Smart Contract Audit | Complete | July 2026 | yAudit |
| Staking Strategies | HederaStakingStrategy, LynxCompositeStakingStrategy, LynxStakingAllocator | yAudit | Smart Contract Audit | Complete | July 2026 | yAudit |
| Governance (DAO) | LynxGovernor, LynxTimelock, LynxVotes | yAudit | Smart Contract Audit | Complete | July 2026 | yAudit |
| Vault Migration | VaultMigrationStrategy | yAudit | Smart Contract Audit | Complete | July 2026 | yAudit |
Current Hedera mainnet deployment after the 26 Aug 2026 cutover. Each ID opens the contract or token on HashScan.
| Contract | Group | Hedera ID | EVM |
|---|---|---|---|
LynxVault | Vault & HTS Bridge | 0.0.10824879 | 0x0000…a52caf |
LynxHTSBridge | Vault & HTS Bridge | 0.0.10824903 | 0x0000…a52cc7 |
LYNX (HTS) | Vault & HTS Bridge | 0.0.9633601 | 0x0000…92ff41 |
StrategyManager | Strategy Manager | 0.0.10824897 | 0x0000…a52cc1 |
SaucerSwapLiquidityStrategy | Liquidity | 0.0.10824909 | 0x0000…a52ccd |
LynxLpAllocator | Liquidity | 0.0.10826537 | 0x0000…a53329 |
LynxCompositeStakingStrategy | Staking | 0.0.10824955 | 0x0000…a52cfb |
LynxStakingAllocator | Staking | 0.0.10824957 | 0x0000…a52cfd |
LynxKeeperRouter | Keeper | 0.0.10826535 | 0x0000…a53327 |
LynxGovernor | Governance | 0.0.10824979 | 0x0000…a52d13 |
LynxTimelock | Governance | 0.0.10824977 | 0x0000…a52d11 |
LynxVotes | Governance | 0.0.10824974 | 0x0000…a52d0e |
VaultMigrationStrategy Cutover relay on the retired June 2026 source manager | Vault Migration | 0.0.10824987 | 0x0000…a52d1b |
35 findings. Developer responses in the report mark every item Fixed. The yAudit write-up has technical detail, impact, and the remediating commits.
Seeding after drain made cutover impossible; seeding an empty live vault let a dust deposit capture migrated NAV. Fixed by minting bridge backing while the successor stays paused, then moving funds.
Permissionless router calls could swap and mint LP with min-out of 0 or 1. Fixed by restricting those routes to the keeper and adding amount-scaled slippage.
Withdrawals reduced the wrong cost basis after selling hold legs, so the next harvest streamed non-existent yield into NAV. Fixed by tracking basis through liquidation.
| ID | Finding | Severity | Status |
|---|---|---|---|
| M-1 | Spot deviation can veto impairment synchronization | medium | Fixed |
| M-2 | Failed pull valuation can leave impairment above principal | medium | Fixed |
| M-3 | Composite deployments lack amount-scaled slippage protection | medium | Fixed |
| M-4 | Cached impairment misprices vault entry and exit | medium | Fixed |
| M-5 | Migration drain can report success while LP positions and tokens remain behind | medium | Fixed |
| M-6 | Migration omits source shares held outside bridge escrow | medium | Fixed |
| M-7 | Loss booking is unreachable because the keeper is the router | medium | Fixed |
| M-8 | Incorrect HTS approveNFT() selector prevents LP position closure | medium | Fixed |
| M-9 | Unvalued pair-token balances enable false loss booking and share dilution | medium | Fixed |
| M-10 | Raw 1:1 share wrapping can exhaust HTS LYNX supply at ~92,233 WHBAR | medium | Fixed |
| M-11 | Permissionless spot-price harvest can persistently understate LP NAV | medium | Fixed |
| L-1 | Extreme composite pool prices can halt the keeper loop | low | Fixed |
| L-2 | Mainnet migration scripts use an incompatible manager ABI | low | Fixed |
| L-3 | Replacing a funded hold leg hides the previous token | low | Fixed |
| L-4 | Quorum tracks optional LynxVotes deposits instead of total share ownership | low | Fixed |
| L-5 | Migration drain cap checks fail after capital is consolidated | low | Fixed |
| L-6 | External fee recipient can block redemptions | low | Fixed |
| L-7 | Unrestricted proposals can weaken allocation-governance safeguards | low | Fixed |
| L-8 | Duplicate position serials in the LP allocator alias enabled state | low | Fixed |
| L-9 | Pausing the vault does not stop permissionless deployment of idle assets | low | Fixed |
| L-10 | Undeployed staking split slices unlock as false vault yield | low | Fixed |
| L-11 | Native HBAR sent to the vault is stranded and cannot be recovered | low | Fixed |
| I-1 | Core contracts lack renewal funding and expire at a fixed date | info | Fixed |
| I-2 | Redeem rounding underpays an external fee recipient | info | Fixed |
| I-3 | Paused vault reports unlimited deposit and mint capacity | info | Fixed |
| I-4 | Default mainnet staking manifest contains testnet hold-token IDs | info | Fixed |
| I-5 | Duplicate composite hold tokens are double-counted in exposure | info | Fixed |
| I-6 | Public deploy calls spend the router’s HBAR reserve on LP mint fees | info | Fixed |
| I-7 | Strategy-reported gains are booked without verifying delivery | info | Fixed |
| I-8 | The timelock delay cannot be updated after deployment | info | Fixed |
| I-9 | LP drain implicitly sweeps the strategy’s entire pair-token balance | info | Fixed |
| I-10 | HSS failures can leave an enabled loop without a pending schedule | info | Fixed |
Source: yAudit “LYNX Token Contracts” report, completed 2026-07-23. Reviewed commits 116b6c5 and b27206b. Fixes landed in follow-up commits listed in the yAudit report.
In addition to yAudit, Lynx runs static analysis, fuzzing, and formal checks in CI. These are engineering gates — not a substitute for the independent report above.
Slither / Aderyn alerts — not yAudit findings. No open exploit path after review.
SaucerSwap LP admin reentrancy ordering
createLPPosition / increaseLPPosition update storage after external SaucerSwap calls. Slither reentrancy-eth; Aderyn H-2.
Payable contracts lock native HBAR
LynxVault, LynxHTSBridge, and SaucerSwapLiquidityStrategy accept native value without a generic withdraw() sweep. Aderyn H-1.
Arbitrary-send-eth on staking wrap
Slither arbitrary-send-eth: LynxKeeperRouter sends native HBAR to configured WHBAR helper during staking harvest wrap.
FullMath caret operator (Aderyn H-2)
Aderyn flags Uniswap V3 FullMath.sol for incorrect use of the caret operator.
Weak randomness on schedule probing
Aderyn H-5 flags prevrandao / pseudo-random slot probing in LynxKeeperRouter schedule discovery.
Full CI logs and artifacts: GitHub Actions. Remaining tool noise (medium/low style flags) is tracked in repo triage, not duplicated here.
