Settlement.sol-The main logic of TSI protocol.-[270]

Library contracts-loan logics and utils.-[308]

__Code Freeze Assurance__

Code of the assets in scope is frozen while the program is live.

Duplicate submissions of bugs are valid. Duplicate submissions of Insights are invalid.

The project commits to keeping private all info related to bug findings until this program is over. This means the project will not leak info about any bug findings or planned bug fixes, including bug findings found independently by the project or from concurrent private audits.

__Insight Reporting__

Insight reports may be reported to this program and do not require a PoC. Insights are rewarded according to [Immunefi’s Standardized Competition Reward Terms](https://immunefisupport.zendesk.com/hc/en-us/articles/31657285001873-Standardized-Competition-Reward-Terms).

__Asset Accuracy Assurance__

Bugs found on assets incorrectly listed in-scope are valid.

__Private Known Issues Reward Policy__

Private known issues, meaning known issues that were not publicly disclosed, are valid for a reward.

__Eligibility Criteria__

Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:
- On OFACs SDN list 
- Official contributor, both past or present
- Employees and/or individuals closely associated with the project 
- Security auditors that directly or indirectly participated in the audit review

__Dispute Resolution__

If there is any dispute over bug reports between projects and security researchers, Immunefi has final say on validity and severity based on the terms of this program.

__Responsible Publication Policy__

Immunefi will publish bug reports, earnings, and a leaderboard for this Invite Only Program. Security Researchers may publish their bug reports as well, but only after Immunefi has published the valid bug reports as part of the competition results.

zeroK

Catchme

https://drive.google.com/file/d/1W6OZ7DwDlMiG7oIcc4Pyt2T1jV2KK9qm/view?usp=sharing

Term Structure Institutional (TSI) is an institutional-grade platform enabling clients to borrow and lend digital assets at fixed rates within the Fireblocks multi-party computation (MPC) wallet environment and a reliable TSI Electronic Communication Network (ECN). TSI empowers institutions, lenders, borrowers, and traders to participate in fixed-income markets with greater efficiency and confidence.

Contract fails to deliver promised returns, but doesn't lose value

Permanent freezing of funds

Protocol insolvency

Theft of unclaimed yield

Theft of unclaimed royalties

Permanent freezing of unclaimed yield

Permanent freezing of unclaimed royalties

Temporary freezing of funds

Temporary freezing of funds for at least 24 hour

Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield

Smart contract unable to operate due to lack of token funds

Block stuffing

Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Theft of gas

Unbounded gas consumption

Temporary freezing of funds for at least 1 hour

__Build Commands, Test Commands, and How to Run Them__

```install denpendencies```
forge soldeer update

```build```
forge build

```test```
forge test –skip Fork

__Previous Audits__

- Term Structure Institutional’s has no audit report as of 28 May 2025.


__Where might Security Researchers confuse out-of-scope code to be in-scope?__

- Security researchers may incorrectly assume that the collateral management system is within scope because they might question whether collateral that is locked in the lender's wallet can be successfully retrieved during liquidation or repayment events. This confusion arises because the retrieval process is partially controlled by the business logic in the backend, which could lead researchers to believe that the collateral locking and unlocking mechanisms are part of the attackable surface area.


__Is this an upgrade of an existing system? If so, which? And what are the main differences?__

- No. This is a new product from scratch.

__Where do you suspect there may be bugs and/or what attack vectors are you most concerned about?__

- We are most concerned about arithmetic overflow and loss of precision issues, which are commonly overlooked in DeFi protocols but can have severe consequences. Given TSI's complex financial calculations, several areas are particularly vulnerable:


__What ERC20 / ERC721 / ERC777 / ERC1155 token standards are supported?__

- ERC20

__What addresses would you consider any bug report requiring their involvement to be out of scope, as long as they operate within the privileges attributed to them?__

- The signer who signs the settlement information is out of scope.

__Which chains and/or networks will the code in scope be deployed to?__

- Ethereum.

__What external dependencies are there?__

- Oracles from Chainlink or RedStone. DEXs for liquidation.

__Are there any unusual points about your protocol that may confuse Security Researchers?__

- All participating addresses use Fireblocks' 2-of-2 Multi-Party Computation (MPC) wallets, where users hold one key share and Fireblocks (not TSI directly) holds the other key share. This creates an unusual custody model that may confuse researchers:

*Key Unusual Points:*

- **Non-Custodial but Coordinated:** While TSI never holds user funds directly, the collateral locking mechanism relies on lender pre-approval rather than traditional smart contract escrow. Lenders must pre-sign transactions that allow the settlement smart contract to automatically transfer collateral from their wallet during repayment or liquidation events.

- **Hybrid Settlement Model:** Unlike typical DeFi protocols where assets are deposited into smart contracts, TSI's settlement contracts facilitate direct wallet-to-wallet transfers. The contracts don't hold funds but coordinate simultaneous exchanges between parties.

- **Backend-Triggered Automation:** TSI's backend system can trigger certain automated actions (like unlocking collateral during liquidation) because it coordinates with Fireblocks' MPC infrastructure, even though TSI doesn't control the private keys directly.

- **Device-Bound Keys:** User key shares are bound to specific browsers/devices, making the typical "connect any wallet" assumption invalid.

Researchers might incorrectly assume TSI has direct key control or that smart contracts hold collateral, when in reality the system uses a sophisticated coordination layer between MPC wallets and pre-authorized transaction execution.

__What are the most valuable educational resources already available? (Ie. Documentation, Explainer videos or articles, etc)__

- [https://docs.institutional.ts.finance/]
- https://www.youtube.com/watch?v=usyhq0ucMOw&list=PLW028xWwhYBHSmzbGLFjd4BybCTrBdjaE

Problems with Oracle and other third-party contracts.

Security issues caused by private key or permission leakage.

Centralization issues related to Fireblock flow, such as allowance management and fund locking mechanism.

TSI Doc

Discover Term Structure Institutional (TSI)

About TSI

__Rewards Terms__

Rewards are distributed among SRs according to [Immunefi’s Standardized Competition Reward Terms](https://immunefisupport.zendesk.com/hc/en-us/articles/31657285001873-Standardized-Competition-Reward-Terms).

Rewards are denominated in USD and distributed in USDC on Ethereum.

The reward pool is $4,000 USD if any bug is found.

If not a single bug is found (Insights do not count as bugs) the reward pool is $360 USD

On top of this, each participating SR will receive a guaranteed reward of $1,000 USD.

**Proof of Concept (PoC) Requirements**

For this program, runnable PoC code is not required. Whitehats are instead required to write a step-by-step explanation of the PoC and impact.

__Insight Rewards Payment Terms__

Insight Rewards: Portion of the Rewards Pool

*The "Insight" severity was introduced on Boost (Audit Competitions) & Attackathon programs to recognize contributions that extend beyond identifying immediate vulnerabilities. Currently, it's not an option to select the Insight severity when submitting a report. However, our team or program will designate it accordingly if applicable. "Insights" underscores our commitment to valuing all types of contributions that contribute to a more secure environment and will always be rewarded. [View more information about Insights](https://immunefisupport.zendesk.com/hc/en-us/articles/13333032674961-Severity-Classification-System?utm_source=immunefi)

Duplicates of Insight reports are not eligible for a reward.

__KYC is Required__

Term Structure Institutional requires KYC information to pay for bug submissions. The following information will be required:
- Full name 
- Date of birth
- Proof of address (either a redacted bank statement with address or a recent utility bill)
- Copy of Passport or other Government issued ID

Security researchers are required to submit KYC within 14 days of KYC being requested, else their rewards may be forfeited. Immunefi may make exceptions due to extenuating circumstances.

NAME	EARNINGS	TOTAL VALID BUGS	CRITICAL	HIGH	MEDIUM/LOW	INSIGHTS
1	$2,089	6	2	2	2	1
2	$1,911	5	2	1	2	1

IOP | Term Structure Institutional

Status

Status