White-hat security researcher discloses two medium-severity vulnerabilities in RangeVaultArbCompoundV5 Arbitrum vault pre-launch: unsafe TWAP for range gating and operator-controlled swap slippage with no on-chain floor.
Tech & Launches ·
A security researcher disclosed two medium-severity vulnerabilities in the RangeVaultArbCompoundV5 vault contract on Arbitrum via an on-chain message, stating that no funds were compromised. The issues center on unsafe range-gating logic that relies on manipulable spot tick data without time-weighted average price protection, and operator-controlled swap slippage with no on-chain safeguard against sandwich attacks if the operator key is compromised.
The vault's factory contract is deployed at 0xfd6Ee65CE2501753216066dcB58EF12c5f5CB6ee on Arbitrum. The researcher offered a 90-day non-disclosure window and indicated the vulnerabilities are fixable ahead of launch, when remediation is cheaper to implement. Full technical details are available through direct on-chain communication with the disclosing address.
The status of the project's response, the timeline for fixes, and whether the vault remains in pre-launch stages are not yet confirmed from the disclosed material.