cyfrin/arcadia-protocol

Audit report · Aug 20, 2026

Audit info

Findings: 224
Duration: 5h 12m
Repository: cyfrin/arcadia-protocol
Branch: main
Git ref: 9f75d15b
Scope: 12 files · 4,638 nSLOC

Security findings

224 Vulnerabilities found

FindingPercentTotal

Critical 2% 4

High 8% 18

Medium 18% 40

Low 31% 70

Informational 27% 60

Gas 14% 32

Context Docs read

known-issues.md
design-decisions.md
trust-model.md
invariants.md
supported-tokens.md

Remediation

224 Recommended remediations

This AI-assisted report covers only the listed scope. Each audit is independent, and repeat runs may show different findings. It does not replace a full human audit.

Need full-system assurance?

Have Cyfrin’s security researchers validate the findings, review the full system, and work directly with your team.

Request an audit

Report findings 224

Critical findings 4 vulnerabilities

Critical control weakness in AccessController.sol Location unavailable Remediation available Critical control weakness in Bridge.sol Resolved location: src/Bridge.sol:42 Remediation available Critical control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:43 Remediation available Critical control weakness in Governance.sol Location unavailable Remediation available

High findings 18 vulnerabilities

Unchecked token transfers across withdrawal paths Resolved location: src/LiquidityPool.sol:41 Remediation available High control weakness in OracleAdapter.sol Resolved location: src/OracleAdapter.sol:42 Remediation available High control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:43 Remediation available High control weakness in Router.sol Location unavailable Remediation available High control weakness in Settlement.sol Resolved location: src/Settlement.sol:45 Remediation available High control weakness in Strategy.sol Resolved location: src/Strategy.sol:46 Remediation available High control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:47 Remediation available High control weakness in WithdrawalQueue.sol Location unavailable Remediation available High control weakness in AccessController.sol Resolved location: src/AccessController.sol:49 Remediation available High control weakness in Bridge.sol Resolved location: src/Bridge.sol:50 Remediation available High control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:51 Remediation available High control weakness in Governance.sol Location unavailable Remediation available High control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:53 Remediation available High control weakness in OracleAdapter.sol Resolved location: src/OracleAdapter.sol:54 Remediation available High control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:55 Remediation available High control weakness in Router.sol Location unavailable Remediation available High control weakness in Settlement.sol Resolved location: src/Settlement.sol:57 Remediation available High control weakness in Strategy.sol Resolved location: src/Strategy.sol:58 Remediation available

Medium findings 40 vulnerabilities

Oracle delay combines with permissive liquidation Resolved location: src/TokenVault.sol:41 Remediation available Medium control weakness in WithdrawalQueue.sol Resolved location: src/WithdrawalQueue.sol:42 Remediation available Medium control weakness in AccessController.sol Resolved location: src/AccessController.sol:43 Remediation available Medium control weakness in Bridge.sol Location unavailable Remediation available Medium control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:45 Remediation available Medium control weakness in Governance.sol Resolved location: src/Governance.sol:46 Remediation available Medium control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:47 Remediation available Medium control weakness in OracleAdapter.sol Location unavailable Remediation available Medium control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:49 Remediation available Medium control weakness in Router.sol Resolved location: src/Router.sol:50 Remediation available Medium control weakness in Settlement.sol Resolved location: src/Settlement.sol:51 Remediation available Medium control weakness in Strategy.sol Location unavailable Remediation available Medium control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:53 Remediation available Medium control weakness in WithdrawalQueue.sol Resolved location: src/WithdrawalQueue.sol:54 Remediation available Medium control weakness in AccessController.sol Resolved location: src/AccessController.sol:55 Remediation available Medium control weakness in Bridge.sol Location unavailable Remediation available Medium control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:57 Remediation available Medium control weakness in Governance.sol Resolved location: src/Governance.sol:58 Remediation available Medium control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:59 Remediation available Medium control weakness in OracleAdapter.sol Location unavailable Remediation available Medium control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:61 Remediation available Medium control weakness in Router.sol Resolved location: src/Router.sol:62 Remediation available Medium control weakness in Settlement.sol Resolved location: src/Settlement.sol:63 Remediation available Medium control weakness in Strategy.sol Location unavailable Remediation available Medium control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:65 Remediation available Medium control weakness in WithdrawalQueue.sol Resolved location: src/WithdrawalQueue.sol:66 Remediation available Medium control weakness in AccessController.sol Resolved location: src/AccessController.sol:67 Remediation available Medium control weakness in Bridge.sol Location unavailable Remediation available Medium control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:69 Remediation available Medium control weakness in Governance.sol Resolved location: src/Governance.sol:70 Remediation available Medium control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:71 Remediation available Medium control weakness in OracleAdapter.sol Location unavailable Remediation available Medium control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:73 Remediation available Medium control weakness in Router.sol Resolved location: src/Router.sol:74 Remediation available Medium control weakness in Settlement.sol Resolved location: src/Settlement.sol:75 Remediation available Medium control weakness in Strategy.sol Location unavailable Remediation available Medium control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:77 Remediation available Medium control weakness in WithdrawalQueue.sol Resolved location: src/WithdrawalQueue.sol:78 Remediation available Medium control weakness in AccessController.sol Resolved location: src/AccessController.sol:79 Remediation available Medium control weakness in Bridge.sol Location unavailable Remediation available

Low findings 70 vulnerabilities

Low control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:41 Remediation available Low control weakness in Governance.sol Resolved location: src/Governance.sol:42 Remediation available Low control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:43 Remediation available Low control weakness in OracleAdapter.sol Location unavailable Remediation available Low control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:45 Remediation available Low control weakness in Router.sol Resolved location: src/Router.sol:46 Remediation available Low control weakness in Settlement.sol Resolved location: src/Settlement.sol:47 Remediation available Low control weakness in Strategy.sol Location unavailable Remediation available Low control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:49 Remediation available Low control weakness in WithdrawalQueue.sol Resolved location: src/WithdrawalQueue.sol:50 Remediation available Low control weakness in AccessController.sol Resolved location: src/AccessController.sol:51 Remediation available Low control weakness in Bridge.sol Location unavailable Remediation available Low control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:53 Remediation available Low control weakness in Governance.sol Resolved location: src/Governance.sol:54 Remediation available Low control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:55 Remediation available Low control weakness in OracleAdapter.sol Location unavailable Remediation available Low control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:57 Remediation available Low control weakness in Router.sol Resolved location: src/Router.sol:58 Remediation available Low control weakness in Settlement.sol Resolved location: src/Settlement.sol:59 Remediation available Low control weakness in Strategy.sol Location unavailable Remediation available Low control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:61 Remediation available Low control weakness in WithdrawalQueue.sol Resolved location: src/WithdrawalQueue.sol:62 Remediation available Low control weakness in AccessController.sol Resolved location: src/AccessController.sol:63 Remediation available Low control weakness in Bridge.sol Location unavailable Remediation available Low control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:65 Remediation available Low control weakness in Governance.sol Resolved location: src/Governance.sol:66 Remediation available Low control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:67 Remediation available Low control weakness in OracleAdapter.sol Location unavailable Remediation available Low control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:69 Remediation available Low control weakness in Router.sol Resolved location: src/Router.sol:70 Remediation available Low control weakness in Settlement.sol Resolved location: src/Settlement.sol:71 Remediation available Low control weakness in Strategy.sol Location unavailable Remediation available Low control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:73 Remediation available Low control weakness in WithdrawalQueue.sol Resolved location: src/WithdrawalQueue.sol:74 Remediation available Low control weakness in AccessController.sol Resolved location: src/AccessController.sol:75 Remediation available Low control weakness in Bridge.sol Location unavailable Remediation available Low control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:77 Remediation available Low control weakness in Governance.sol Resolved location: src/Governance.sol:78 Remediation available Low control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:79 Remediation available Low control weakness in OracleAdapter.sol Location unavailable Remediation available Low control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:81 Remediation available Low control weakness in Router.sol Resolved location: src/Router.sol:82 Remediation available Low control weakness in Settlement.sol Resolved location: src/Settlement.sol:83 Remediation available Low control weakness in Strategy.sol Location unavailable Remediation available Low control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:85 Remediation available Low control weakness in WithdrawalQueue.sol Resolved location: src/WithdrawalQueue.sol:86 Remediation available Low control weakness in AccessController.sol Resolved location: src/AccessController.sol:87 Remediation available Low control weakness in Bridge.sol Location unavailable Remediation available Low control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:89 Remediation available Low control weakness in Governance.sol Resolved location: src/Governance.sol:90 Remediation available Low control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:91 Remediation available Low control weakness in OracleAdapter.sol Location unavailable Remediation available Low control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:93 Remediation available Low control weakness in Router.sol Resolved location: src/Router.sol:94 Remediation available Low control weakness in Settlement.sol Resolved location: src/Settlement.sol:95 Remediation available Low control weakness in Strategy.sol Location unavailable Remediation available Low control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:97 Remediation available Low control weakness in WithdrawalQueue.sol Resolved location: src/WithdrawalQueue.sol:98 Remediation available Low control weakness in AccessController.sol Resolved location: src/AccessController.sol:99 Remediation available Low control weakness in Bridge.sol Location unavailable Remediation available Low control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:101 Remediation available Low control weakness in Governance.sol Resolved location: src/Governance.sol:102 Remediation available Low control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:103 Remediation available Low control weakness in OracleAdapter.sol Location unavailable Remediation available Low control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:105 Remediation available Low control weakness in Router.sol Resolved location: src/Router.sol:106 Remediation available Low control weakness in Settlement.sol Resolved location: src/Settlement.sol:107 Remediation available Low control weakness in Strategy.sol Location unavailable Remediation available Low control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:109 Remediation available Low control weakness in WithdrawalQueue.sol Resolved location: src/WithdrawalQueue.sol:110 Remediation available

Informational findings 60 notes

Informational control weakness in AccessController.sol Resolved location: src/AccessController.sol:41 Remediation available Informational control weakness in Bridge.sol Resolved location: src/Bridge.sol:42 Remediation available Informational control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:43 Remediation available Informational control weakness in Governance.sol Location unavailable Remediation available Informational control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:45 Remediation available Informational control weakness in OracleAdapter.sol Resolved location: src/OracleAdapter.sol:46 Remediation available Informational control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:47 Remediation available Informational control weakness in Router.sol Location unavailable Remediation available Informational control weakness in Settlement.sol Resolved location: src/Settlement.sol:49 Remediation available Informational control weakness in Strategy.sol Resolved location: src/Strategy.sol:50 Remediation available Informational control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:51 Remediation available Informational control weakness in WithdrawalQueue.sol Location unavailable Remediation available Informational control weakness in AccessController.sol Resolved location: src/AccessController.sol:53 Remediation available Informational control weakness in Bridge.sol Resolved location: src/Bridge.sol:54 Remediation available Informational control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:55 Remediation available Informational control weakness in Governance.sol Location unavailable Remediation available Informational control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:57 Remediation available Informational control weakness in OracleAdapter.sol Resolved location: src/OracleAdapter.sol:58 Remediation available Informational control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:59 Remediation available Informational control weakness in Router.sol Location unavailable Remediation available Informational control weakness in Settlement.sol Resolved location: src/Settlement.sol:61 Remediation available Informational control weakness in Strategy.sol Resolved location: src/Strategy.sol:62 Remediation available Informational control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:63 Remediation available Informational control weakness in WithdrawalQueue.sol Location unavailable Remediation available Informational control weakness in AccessController.sol Resolved location: src/AccessController.sol:65 Remediation available Informational control weakness in Bridge.sol Resolved location: src/Bridge.sol:66 Remediation available Informational control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:67 Remediation available Informational control weakness in Governance.sol Location unavailable Remediation available Informational control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:69 Remediation available Informational control weakness in OracleAdapter.sol Resolved location: src/OracleAdapter.sol:70 Remediation available Informational control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:71 Remediation available Informational control weakness in Router.sol Location unavailable Remediation available Informational control weakness in Settlement.sol Resolved location: src/Settlement.sol:73 Remediation available Informational control weakness in Strategy.sol Resolved location: src/Strategy.sol:74 Remediation available Informational control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:75 Remediation available Informational control weakness in WithdrawalQueue.sol Location unavailable Remediation available Informational control weakness in AccessController.sol Resolved location: src/AccessController.sol:77 Remediation available Informational control weakness in Bridge.sol Resolved location: src/Bridge.sol:78 Remediation available Informational control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:79 Remediation available Informational control weakness in Governance.sol Location unavailable Remediation available Informational control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:81 Remediation available Informational control weakness in OracleAdapter.sol Resolved location: src/OracleAdapter.sol:82 Remediation available Informational control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:83 Remediation available Informational control weakness in Router.sol Location unavailable Remediation available Informational control weakness in Settlement.sol Resolved location: src/Settlement.sol:85 Remediation available Informational control weakness in Strategy.sol Resolved location: src/Strategy.sol:86 Remediation available Informational control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:87 Remediation available Informational control weakness in WithdrawalQueue.sol Location unavailable Remediation available Informational control weakness in AccessController.sol Resolved location: src/AccessController.sol:89 Remediation available Informational control weakness in Bridge.sol Resolved location: src/Bridge.sol:90 Remediation available Informational control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:91 Remediation available Informational control weakness in Governance.sol Location unavailable Remediation available Informational control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:93 Remediation available Informational control weakness in OracleAdapter.sol Resolved location: src/OracleAdapter.sol:94 Remediation available Informational control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:95 Remediation available Informational control weakness in Router.sol Location unavailable Remediation available Informational control weakness in Settlement.sol Resolved location: src/Settlement.sol:97 Remediation available Informational control weakness in Strategy.sol Resolved location: src/Strategy.sol:98 Remediation available Informational control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:99 Remediation available Informational control weakness in WithdrawalQueue.sol Location unavailable Remediation available

Gas findings 32 notes

Gas control weakness in AccessController.sol Resolved location: src/AccessController.sol:41 Remediation available Gas control weakness in Bridge.sol Resolved location: src/Bridge.sol:42 Remediation available Gas control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:43 Remediation available Gas control weakness in Governance.sol Location unavailable Remediation available Gas control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:45 Remediation available Gas control weakness in OracleAdapter.sol Resolved location: src/OracleAdapter.sol:46 Remediation available Gas control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:47 Remediation available Gas control weakness in Router.sol Location unavailable Remediation available Gas control weakness in Settlement.sol Resolved location: src/Settlement.sol:49 Remediation available Gas control weakness in Strategy.sol Resolved location: src/Strategy.sol:50 Remediation available Gas control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:51 Remediation available Gas control weakness in WithdrawalQueue.sol Location unavailable Remediation available Gas control weakness in AccessController.sol Resolved location: src/AccessController.sol:53 Remediation available Gas control weakness in Bridge.sol Resolved location: src/Bridge.sol:54 Remediation available Gas control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:55 Remediation available Gas control weakness in Governance.sol Location unavailable Remediation available Gas control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:57 Remediation available Gas control weakness in OracleAdapter.sol Resolved location: src/OracleAdapter.sol:58 Remediation available Gas control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:59 Remediation available Gas control weakness in Router.sol Location unavailable Remediation available Gas control weakness in Settlement.sol Resolved location: src/Settlement.sol:61 Remediation available Gas control weakness in Strategy.sol Resolved location: src/Strategy.sol:62 Remediation available Gas control weakness in TokenVault.sol Resolved location: src/TokenVault.sol:63 Remediation available Gas control weakness in WithdrawalQueue.sol Location unavailable Remediation available Gas control weakness in AccessController.sol Resolved location: src/AccessController.sol:65 Remediation available Gas control weakness in Bridge.sol Resolved location: src/Bridge.sol:66 Remediation available Gas control weakness in FeeManager.sol Resolved location: src/FeeManager.sol:67 Remediation available Gas control weakness in Governance.sol Location unavailable Remediation available Gas control weakness in LiquidityPool.sol Resolved location: src/LiquidityPool.sol:69 Remediation available Gas control weakness in OracleAdapter.sol Resolved location: src/OracleAdapter.sol:70 Remediation available Gas control weakness in PositionManager.sol Resolved location: src/PositionManager.sol:71 Remediation available Gas control weakness in Router.sol Location unavailable Remediation available