Shadow Arena #004: Flux Finance

Flux Finance is a Compound V2 fork with KYC/sanctions checks, plus a CASH token minting and redemption system. The lending contracts are forked from Compound's cDAI. The scope spans both lending mechanics and the cash management layer. Some bugs are in the familiar Compound fork, others are in the novel CASH token system.

Scope (4365 SLOC)

File	SLOC	Description
contracts/lending/CTokenCash.sol	687	Modified CToken for CASH token markets with KYC checks
contracts/lending/CTokenModified.sol	690	Base CToken with sanctions/KYC integration
contracts/lending/CCash.sol	142	CErc20 equivalent for CASH token
contracts/lending/CErc20.sol	142	Standard CErc20 implementation
contracts/lending/JumpRateModelV2.sol	103	Interest rate model with updated blocksPerYear
contracts/lending/OndoPriceOracle.sol	50	Custom price oracle for Ondo assets
contracts/lending/OndoPriceOracleV2.sol	158	V2 oracle with Chainlink integration
contracts/cash/CashManager.sol	600	CASH token minting/redemption with KYC and epoch system
contracts/cash/CashKYCSender.sol	150	CASH token with KYC sender check
contracts/cash/CashKYCSenderReceiver.sol	150	CASH token with KYC sender and receiver checks
contracts/cash/KYCRegistry.sol	200	On-chain KYC verification registry

Documentation

Source Code Protocol Docs

Part of the Compound V2 Path

This shadow audit connects to the Compound V2 Build module. Students who built the lending protocol have an advantage because they understand the core architecture.

View Build Module

Duration2 days

Total Findings6

Scope4365 SLOC

PriceFree