Firepan · Audit Report · FP-AUDT-2026-0002
Yield Basis FeeDistributor Audit
Firepan's audit of Yield Basis' FeeDistributor contract (Vyper 0.4.3, Ethereum mainnet), covering five review rounds plus a Tier-1 deployment-invariant scrub.
Engagement Summary
- 0 High, 1 Medium, 6 Low, 13 Info findings, plus 2 clean surfaces investigated and cleared
- The single Medium — a divide-by-zero DoS in
_claimwhen an epoch has zero total votes — is latent on current mainnet state (716 continuously-locked veNFTs since 2025-09-15) but reachable on any fresh redeploy against a clean VotingEscrow - Two Low findings were reclassified to Info after Yield Basis team review confirmed they were by-design (adversarial-friendly gas-shift patterns, not value extraction)
- A later Tier-1 deployment-invariant pass added two novel Low findings: an unguarded empty initial token set, and stale balance snapshots across kill/recover/unkill admin cycles
Notable Findings
| ID | Severity | Finding |
|---|---|---|
| F-1 | Medium | Divide-by-zero DoS in _claim when total_votes == 0 for an epoch — permanent per-user lockout on any fresh redeploy against an empty VotingEscrow; latent on current mainnet state. |
| F-6 | Low | range(50) silently truncates token-set iteration if an admin ever adds more than 50 token sets in a single epoch — no event, no revert, just missing balances. |
| F-10 | Low | fill_epochs cursor timing creates a novel MEV surface at week-boundary fills — measured 2.78% of pool shifted by a 1-second timing swing. |
| F-20 | Low | Empty initial token_set silently deploys with no guard, permanently distributing zero fees until an admin notices. |
| F-21 | Low | kill_toggle leaves token_balances stale across kill→recover→unkill cycles, silently absorbing fresh deposits below the stale snapshot. |