Shadow Arena #013: Tapioca DAO (Full Contest)

Tapioca DAO is a Liquity-inspired CDP shipped inside a cross-chain stack: BigBang mints USDO against ETH (and later non-ETH) collateral, Singularity is a Compound-style isolated lending pair sitting next door, YieldBox is the share-based strategy layer underneath both, and TOFT is the LayerZero-based Omnichain Fungible Token system that lets users move collateral and debt between chains. Code4rena ran the audit in July-August 2023 with 134 wardens, a $390,000 prize pool, and 13,499 SLOC across 5 sub-repos. The contest yielded 60 High + 99 Medium + 79 Low/NC findings -- the largest finding count of any Shadow Arena entry by an order of magnitude. This is the boss fight of the four Liquity-fork picks. You've built Liquity V1, you've audited Gravita's multi-collateral fork, you've audited Lybra's LSD-collateral fork. Tapioca is what happens when the same CDP primitives ship inside a 13,500-line cross-chain stack. We curated 16 findings that map directly onto the Liquity V1 mental model -- the BigBang/USDO CDP bugs, the Singularity liquidation accounting bugs, the YieldBox share-vs-amount confusion, the TOFT cross-chain symmetry breaks, and the oracle/fee pricing inconsistencies. The other 143 findings are bonus material in the linked C4 report if you want to go deeper. Note: Tapioca was exploited in October 2024 for ~$4M via a signer key compromise, an attack vector entirely separate from the 2023 audit findings. The bugs in this entry are pre-exploit, were fixed in the audited codebase, and are not in any active bug-bounty scope. Four weeks. Go.

Scope (13499 SLOC)

Documentation