Flare is the blockchain for data. It is a layer-1, EVM smart contract platform designed to expand the utility of blockchain by delivering data certainty for dApp builders.


Manipulation of governance voting result deviating from voted outcome and resulting in a direct change from intended effect of original results

Protocol insolvency

Smart contract unable to operate due to lack of token funds

Contract fails to deliver promised returns, but doesn't lose value

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Permanent freezing of funds

Theft of unclaimed yield

Theft of unclaimed royalties

Permanent freezing of unclaimed yield

Permanent freezing of unclaimed royalties

Temporary freezing of funds

Block stuffing

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption

Temporary freezing of funds for at least 24 hour

Temporary freezing of funds for at least 1 hour

Triggering instructions might run out of gas: the size of the allowed destination addresses will be low (5-10).

Array of escrows always grows: the number of escrows created will be low (if it is more than one or two, we will increase the daily escrow amount). So the total number of escrows will not be huge, perhaps a few hundred.

Escrows finalized close to expiry time decouple the Core Vault internal accountancy: before escrows are released, the triggering bots will be shut down, and they will only be enabled after setEscrowsFinished is called. So there will be no instructions triggered between escrow finalization and the corresponding update on the core vault manager.

Users are unprotected against missing or malformed vault redemption payments: in that case, we assume the core vault has full trust, and its redemptions don't have a time limit. Also, core-vault redeemers are special entities.

Flare FAssets | Mitigation Audit

Starting in

Starting in

This Audit Competition Is Starting Soon