Every contract is verified on-chain — read the source yourself. Below: an automated static-analysis pass with Slither (Trail of Bits) and a manual code review. This is tooling output and an internal review, not a certified third-party audit.
| Contract | Address · Blockscout |
|---|---|
| Exchange the pool | 0xC8017e08CB5a8948D9cc9DED6D90f85bD813C382 |
| PriceRelay | 0xb6ee07Ab358f6223F3b56a764De49FB52DC96F9b |
| SessionRouter | 0x8E7a8139a7602ac99b6BCf6e089463D4E696B4Ec |
| HouseShare | 0x49dc3eBD3C5E380810D579f7db6a9eA45991DF89 |
| Staking | 0xb85Ba9dD979A54256a9001Dcb0A7dC948Ba72853 |
| Reserve | 0x063B8f140E3682D453876Ef240257E53582fF135 |
| Treasury | 0xDcd51A79339F194001EB8ef9Cdc21911810d4Fe2 |
The House pool balance changes in exactly four places in Exchange.sol, none of which sends to a chosen address:
There is no withdraw / sweep / rescue for pool principal — not for the owner, not for anyone. Reserve can only flow to the Exchange queue; Treasury ETH only leaves through a fixed waterfall; Staking pays only the staker; HouseShare is non-transferable. Funds are self-custodial.
solc 0.8.26 · optimizer runs 200 · viaIR · 102 detectors · OZ Contracts 5.4.0
| Contract | High | Medium | Low | Info |
|---|---|---|---|---|
| Exchange | 1 | 24 | 71 | 63 |
| PriceRelay | 1 | 12 | 12 | 25 |
| HouseShare | 0 | 5 | 15 | 11 |
| Staking | 1 | 2 | 17 | 18 |
| Reserve | 0 | 1 | 6 | 12 |
| Treasury | 2 | 1 | 7 | 9 |
All 5 "High" flags triaged — none exploitable:
_drawReserve / Staking claim reentrancy — both nonReentrant, checks-effects-interactions, SafeERC20. Guarded.arbitrary-send-eth ×2 — by design: sends only to fixed sinks (Reserve/Buyback/Staking) along a hard-coded waterfall; no caller-controlled recipient; owner cannot withdraw.incorrect-exp — false positive inside OpenZeppelin Math.sol, not protocol code.Medium flags are fixed-point divide-before-multiply (intentional 1e18/1e8 scaling), == 0 zero-checks on counters, guarded reentrancy, and zero-initialized locals assigned before use. No fund-loss issue found.
The main risk is not custody — it is trust in the price-relayer quorum. Marks are quorum-signed HIP-3 prices; both mark and oracle come from Hyperliquid, so the external check is the Chainlink breaker (currently 3%) while fresh, plus per-position notional caps, OI caps and the winner haircut. These bound damage but do not remove trust in the relayer set. See the full writeup in the reports below.