A transparent security review of the INDEX8 vault contract against recognized standards, with the protections in place and the residual risks disclosed openly — so you can decide with full information.
Standards & references used:
These properties were reviewed and are enforced by the contract:
No vulnerability was found that lets an arbitrary user drain or steal funds. The items below are inherent design trade-offs and risks, disclosed in full.
| # | Area | Severity | Status / mitigation |
|---|---|---|---|
| F1 | Owner is a powerful, trusted role (can change fees, assets, keeper, guards, pause) | Centralization | Disclosed below. Recommend owner = multisig/timelock for production. |
| F2 | First-deposit "inflation" attack on an empty vault | Medium | Mitigated operationally: the operator seeds the first mint. See below. |
| F3 | Reliance on Chainlink oracles for all pricing | Low | Staleness + positive-price checks; Chainlink is industry standard. |
| F4 | MEV / sandwiching on public rebalance swaps | Low | Loss bounded by the per-swap oracle slippage floor. |
| F5 | Thin-liquidity coins may revert on rebalance | Low | No loss — the swap simply reverts; funds stay in the vault. |
| F6 | removeAsset can strand up to a small dust value | Info | Bounded by a configurable dust threshold (~$1). |
| F7 | Immutable contract (no upgrade proxy) | By design | No upgrade-key risk; bugs would require redeploy + migration. |
| F8 | Drain by an arbitrary (non-owner) actor | Not found | The custody design prevents it. |
The owner can change fees (≤5%), add/remove basket coins, set the keeper, whitelist DEX routers, adjust the swap guardrails, and pause. A malicious or compromised owner could, over time, leak value (e.g. by whitelisting a bad router and trading at the maximum allowed slippage). You are trusting the owner. For real scale, the owner key should be a multisig or timelock. Today this is a private friends' fund run by the builder.
Like most vault contracts, an empty vault is theoretically exposed to a "first-deposit inflation" trick. We mitigate this by having the operator perform the first, seeding mint. As a depositor, only mint into a vault that already holds value (the app shows the basket and NAV).
NAV — and therefore every mint and redeem — is priced by Chainlink feeds. If a feed were wrong or compromised, NAV would be wrong. We use staleness and positive-price checks, and Chainlink is the industry standard, but this dependency is real.
The code is covered by 24 automated tests and a live mainnet-fork test, and was reviewed against the standards above — but it has not been audited by an independent security firm. Treat it accordingly: start small.
Everything is on-chain and public. You don't have to trust this page: