Shadow Arena #009: Popcorn Protocol

Popcorn Protocol is a multi-chain yield-optimizing protocol built on Yearn V2 patterns. The architecture decouples the system into Vaults (ERC-4626 deposit layer), Adapters (yield source wrappers), Strategies (auxiliary logic executed via delegatecall), and a VaultController factory that clones and registers new vaults from approved templates. The protocol layers a MultiRewardStaking contract on top to distribute additional incentives in arbitrary reward tokens.

Scope (2694 SLOC)

File	SLOC	Description
src/vault/Vault.sol	426	ERC-4626 vault implementation. Routes deposits and withdrawals to an Adapter, mints shares, charges fees
src/vault/VaultController.sol	520	Factory for cloning vaults, adapters, and staking contracts from approved templates
src/vault/adapter/abstracts/AdapterBase.sol	405	Abstract base for ERC-4626 adapters. Holds underlying balance, performance fee accounting, and strategy delegatecall logic
src/utils/MultiRewardStaking.sol	311	Staking contract that wraps vault shares and distributes multiple reward tokens over time
src/utils/MultiRewardEscrow.sol	142	Time-locked escrow for streamed reward tokens with optional early-exit penalty
src/vault/adapter/yearn/YearnAdapter.sol	110	Adapter that wraps a Yearn V2 yvToken as a yield source
src/vault/adapter/beefy/BeefyAdapter.sol	145	Adapter that wraps a Beefy mooToken vault, optionally with a booster contract
src/utils/TemplateRegistry.sol	95	Registry of approved implementation templates used by VaultController for cloning
src/utils/PermissionRegistry.sol	45	Allow/deny list of endorsed and rejected addresses consulted at deployment time
src/utils/CloneFactory.sol	48	Minimal CREATE2 clone factory used by VaultController
src/utils/CloneRegistry.sol	47	Tracks every clone deployed by the factory and the template it was cloned from
src/vault/strategy/StrategyBase.sol	60	Abstract base for strategy contracts that are invoked by adapters via delegatecall
src/utils/AdminProxy.sol	22	Minimal proxy used by the VaultController to perform privileged actions on cloned contracts
src/vault/adapter/abstracts/WithRewards.sol	18	Abstract mixin for adapters that claim and forward auxiliary reward tokens
src/vault/adapter/abstracts/EIP165.sol	15	ERC-165 helpers for adapter type discovery
src/vault/adapter/abstracts/OnlyStrategy.sol	12	Modifier mixin restricting strategy hook entry points
src/vault/strategy/RadiantUtilsStrategy.sol	122	Sample strategy for Radiant rewards, executed via delegatecall by the adapter
src/vault/strategy/ConvexCompoundStrategy.sol	152	Sample strategy for Convex compounding, executed via delegatecall by the adapter

Documentation

Source Code Protocol Docs

Part of the Uniswap V2 Path

This shadow audit connects to the Uniswap V2 Build module. Students who completed the CFAMM build have an advantage because they understand the core architecture.

View Build Module

Duration7 days

Total Findings6

Scope2694 SLOC

PriceFree