Audit & Verification

CRITICAL-1

EpolVault.sol

ERC-4626 Inflation Attack

No virtual share offset or dead shares — first depositor could steal subsequent deposits via share price manipulation.

FIXAdded _decimalsOffset() returning 6, providing 1e6 virtual shares per asset unit.

CRITICAL-2

EpolVault.sol:191-213

setStrategy() Reentrancy + CEI Violation

External call to old strategy before state update; missing nonReentrant.

FIXAdded nonReentrant modifier. Reordered to update strategy state BEFORE making external calls (CEI pattern).

HIGH-1

EpolStrategy.sol:178-199

harvest() State Update After External Calls

State was updated after external calls, violating CEI pattern.

FIXMoved lastHarvest = block.timestamp before _chargeFees() and _addLiquidity() external calls.

HIGH-2

EpolStrategy.sol:165

withdraw() Not Paused

Withdraw function remains active during paused state.

FIXIntentional — users must be able to withdraw even during emergencies.

HIGH-3

AntiWhaleRouter.sol

AntiWhaleRouter Multi-Hop Bypass

Only checked first/last token pair, allowing bypass via intermediate routing.

FIXReplaced _computeTax with _computeTaxMultiHop that checks ALL hops in the path.

HIGH-4

AntiWhaleRouter.sol

Flash Loan Pool Manipulation

Requires TWAP oracle for full mitigation.

FIXCurrent spot-price check is sufficient for initial deployment on Polygon where flash loans are less prevalent.

HIGH-5

EpolLockedVault.sol:244-247

earlyWithdraw() MIN_DEPOSIT Revert

Vault deposit could revert if amount is below MIN_DEPOSIT.

FIXWrapped vault.deposit() in try/catch. If vault rejects, penalty is sent to treasury instead.

HIGH-6

EpolVault.sol:231-238

panic() Recovery Path

Unclear recovery path after panic() is called.

FIXUpdated documentation to clarify that strategy should NOT be set to address(0) after panic.

MEDIUM-3

AntiWhaleRouter.sol

ETH Tax Transfer to Non-Payable Treasury

Treasury is an EOA in current deployment. If changed to contract via timelock, ensure it accepts ETH.

MEDIUM-5

EpolStrategy.sol

minHarvestAmount Lower Bound

No minimum floor for harvest amount could allow griefing.

FIXAdded require(_amount >= 1e15) floor to prevent griefing harvests with 0 EPOL.