Flare FAssets audit details

• Total Prize Pool: $190,000 in USDC
  • HM awards: up to $168,000 in USDC
    • If no valid Highs or Mediums are found, the HM pool is $0
  • QA awards: $7,000 in USDC
  • Judge awards: $3,500 in USDC
  • Scout awards: $500 in USDC
  • Mitigation Review: $11,000 in USDC
• Read our guidelines for more details
• Starts August 19, 2025 20:00 UTC
• Ends September 23, 2025 20:00 UTC

❗ Important notes for wardens

1. Since this audit includes live/deployed code, all submissions will be treated as sensitive:

   • Wardens are encouraged to submit High-risk submissions affecting live code promptly, to ensure timely disclosure of such vulnerabilities to the sponsor and guarantee payout in the case where a sponsor patches a live critical during the audit.
   • Submissions will be hidden from all wardens (SR and non-SR alike) by default, to ensure that no sensitive issues are erroneously shared.
   • If the submissions include findings affecting live code, there will be no post-judging QA phase. This ensures that awards can be distributed in a timely fashion, without compromising the security of the project. (Senior members of C4 staff will review the judges’ decisions per usual.)
   • By default, submissions will not be made public until the report is published.
   • Exception: if the sponsor indicates that no submissions affect live code, then we’ll make submissions visible to all authenticated wardens, and open PJQA to SR wardens per the usual C4 process.
   • The "live criticals" exception therefore applies.

2. A coded, runnable PoC is required for all High/Medium submissions to this audit.

   • This repo includes a basic template to run the test suite.
   • It is preferable to submit your PoC in Hardhat, using the test suite provided in the audit repo.
   • Foundry PoCs will only be accepted if you provide instructions to run it within the existing test suite.
   • Please check your formatting to ensure that it runs properly.
   • Your submission will be marked as Insufficient if the POC is not runnable and working with the provided test suite.
   • Exception: PoC is optional (though recommended) for wardens with signal ≥ 0.68.

3. Judging phase risk adjustments (upgrades/downgrades):

   • High- or Medium-risk submissions downgraded by the judge to Low-risk (QA) will be ineligible for awards.
   • Upgrading a Low-risk finding from a QA report to a Medium- or High-risk finding is not supported.
   • As such, wardens are encouraged to select the appropriate risk level carefully during the submission phase.

Automated Findings / Publicly Known Issues

The 4naly3er report can be found here.

Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.

Any submissions pertaining to issues identified within the Immunefi report, that are received after August 25th at 11:18 AM UTC, will be considered out of scope.

Overview

FAssets bring non-smart contract assets like XRP into DeFi — securely, scalably, and with full custody retained.

This repository is a implementation of the system: solidity contracts for Flare Foundation FAsset.

Details

The FAsset contracts are used to mint assets on top of Flare. The system is designed to handle chains which don’t have smart contract capabilities. Initially, FAsset system will support XRP native asset on XRPL. At a later date BTC, DOGE, add tokens from other blockchains will be added.

The minted FAssets are secured by collateral, which is in the form of ERC20 tokens on Flare/Songbird chain and native tokens (FLR/SGB). The collateral is locked in contracts that guarantee that minted tokens can always be redeemed for underlying assets or compensated by collateral. Underlying assets can also be transferred to Core Vault, a vault on the underlying network. When the underlying is on the Core Vault, the agent doesn’t need to back it with collateral so they can mint again or decide to withdraw this collateral.

Two novel protocols, available on Flare and Songbird blockchains, enable the FAsset system to operate:

• FTSO contracts which provide decentralized price feeds for multiple tokens.
• Flare’s FDC, which bridges payment data from any connected chain.

Links

• Previous audits: https://dev.flare.network/support/audits
• Documentation: https://dev.flare.network/fassets/overview
• Tests with sample attack scenarios: https://github.com/code-423n4/2025-08-flare/blob/main/test/integration/assetManager/AttackScenarios.ts
• Website: https://flare.network/
• X/Twitter: https://x.com/FlareNetworks

---

Scope

Tokens in scope

The FAssets system is able to support wrapped tokens for XRP, BTC and DOGE. However, the initial deployment will only have XRP (FXRP) enabled and that will be the sole scope of this audit competition. Any attacks related to FBTC, FDOGE, or UTXO-based logic in general, are out of scope.

Files in scope

See scope.txt

Files out of scope

See out_of_scope.txt

Additional context

Areas of concern (where to focus for bugs)

• Bugs in Core Vault logic and interaction
• Bugs in smart contracts, protocol bugs.
• Accounting bugs, mostly when interacting cross chain.

Main invariants

Further documentation of the system design is forthcoming and will be added to this README as soon as it’s available.

All trusted roles in the protocol

Note: Vulnerabilities requiring access to the Agent role might be limited to medium severity due to accountability/recourse (subject to the discretion of the judge)

Running tests

# Clone repository:
git clone https://github.com/code-423n4/2025-08-flare.git
cd 2025-08-flare

# Install dependencies & compile Solidity code:
yarn
yarn c

Run tests:

• yarn testHH - all tests in Hardhat environment (includes following two types of tests).
• yarn test_unit_hh - only unit tests in hardhat environment.
• yarn test_integration_hh - only integration tests in hardhat environment.

Check test coverage:

yarn test-with-coverage

Miscellaneous

Employees of Flare and employees' family members are ineligible to participate in this audit.

Code4rena's rules cannot be overridden by the contents of this README. In case of doubt, please check with C4 staff.