Flare - fAsset Mitigation Review

Total Prize Pool: $11,000 in USDC
- Warden awards: $9,500 in USDC
- Judge awards: $1,250 in USDC
- Scout awards: $250 in USDC
Warden guidelines for C4 mitigation reviews
Starts October 27, 2025 20:00 UTC
Ends October 30, 2025 20:00 UTC

❗ Important notes for wardens

This Mitigation Review will use a multi-round format (maximum 3 rounds) and will not be considered complete until all fixes are fully resolved.
- Round Timeline: Each review round is scheduled for 2-4 days. If unmitigated statuses or new issues caused by fixes are found, the Flare team will re-mitigate for a subsequent round.
- 70% HM Pool: Divided among new High/Medium severity findings across all rounds.
- 30% Participation Pool: Based on participation across all rounds.
  - Commitment Note: To be eligible for your full share of the Participation Pool, you must be available to participate in all subsequent rounds until the MR is officially closed.
  - If no new HM findings are identified, the HM pool is added to the Participation pool.
Each warden must submit a mitigation review for every individual item listed in the Scope section below. Incomplete or insufficient mitigation reviews will not be eligible for awards.

Scope

Mitigations of all High and Medium issues listed here will be considered in-scope:

Fix	Mitigation of	Notes
Commit e7723fa08	S-217: Vault owner is incentivized to not switch invalid collateral token, during liquidation	Removed token deprecation and agent vault token switching
Commit a70e82119	S-540: Accumulated rewards in FSTO can be stolen by the agent's owner	`upgradeWNatContract` must now be called by governance or executor
Commit 1d389c2f8	S-558: Agent underlying balance can be inflated, which cannot be prove-able to challenge it as illegal.	Payments before first redemption block can be challenged