Hyperlend is a lending protocol deployed on the Hyperliquid chain. The protocol implements risk-segmented lending pools designed for different use cases. The protocol\u2019s infrastructure includes cross-chain deposit endpoints for protocol pools, looping contracts that enable position management through flash loans, and helper contracts for asset listing functionality.<\/p>\n
Hyperlend engaged Ackee Blockchain Security to perform a security review of the Hyperlend protocol with a total time donation of 46 engineering days in a period between January 10 and February 7, 2025.<\/p>\n
A second, fix review was then performed between February 17 and February 24, 2025.<\/p>\n
A third review was then performed between March 12 and March 18.<\/p>\n
We began our review with a deep dive into the logic of the contracts. We supported our review with static analysis tools, including Wake<\/a>, and manually guided fuzzing checking basic functionality of the code in-scope.<\/p>\n During the review, we paid special attention to:<\/p>\n The audit was performed on the following repositories and commits:<\/p>\n The fix review was performed on the following repositories and commits:<\/p>\n The third audit was performed on the hyperlend-core-new repository, commit The classification of a security finding is determined by two ratings: <\/span>impact<\/b> and <\/span>likelihood<\/b>. This two-dimensional classification helps clarify the severity of individual issues. Issues which would be rated as <\/span>medium<\/span><\/i> severity, but which would be likely discovered only by the team, are typically decreased by the likelihood factor to the W<\/em><\/span>arning<\/span><\/i> or I<\/em><\/span>nformational<\/span><\/i> severity ratings.<\/span><\/p>\n Our review resulted in 44 findings, ranging from Info to Critical severity. The most severe finding C1 posed a critical risk of all collateral tokens being stolen from the isolated pools of the protocol. The finding was reported despite being out-of-scope for the review, as the core issue was in incorrect usage of a new Chainlink-like price provider in the context of the original Fraxlend V3 codebase. The issue was undetectable by performing only differential review without the context of the original codebase.<\/p>\n Findings C1, M1, M2, M7, M10, L2 were discovered through manually-guided fuzzing using the Wake<\/a> testing framework. Findings M5, M10, M11, M13, and I10 were discovered through Wake<\/a> static analysis.<\/p>\n C1: No revert on stale Chainlink price<\/p>\n H1: Possible locked tokens<\/p>\n M1: Incorrect proposal ID emitted<\/p>\n M2: Missing support for bridging native tokens<\/p>\n M3: Arbitrary token transfer through unrestricted refund function<\/p>\n M4: Incorrect token balance check leading to failed position closures<\/p>\n M5: Divide before multiply in M6: Missing M7: M8: Inconsistent token symbol formatting<\/p>\n M9: Missing token validation on bridge initiation<\/p>\n M10: M11: Native M12: M13: Missing Chainlink price feed validation<\/p>\n L1: Missing swap deadline protection<\/p>\n L2: Try\/catch may still revert<\/p>\n L3: Unsatisfiable condition on closing position with flashloans<\/p>\n L4: Incorrect error messages<\/p>\n L5: Missing receive function for native token handling<\/p>\n L6: Missing queued transaction verification in L7: Same transaction can be queued multiple times<\/p>\n L8: Native token recovery can be bypassed<\/p>\n W1: Missing check to catch underflow error<\/p>\n W2: Double listing proposal ID<\/p>\n W3: Case insensitive import<\/p>\n W4: Hardhat console imports<\/p>\n W5: Unused state variables in W6: Missing zero address validation<\/p>\n W7: Lack of events<\/p>\n W8: Missing proposal existence validation<\/p>\n W9: Potential negative exponent in W10: Incorrect token balance used for debt value calculation<\/p>\n I1: Missing underscore in internal function name<\/p>\n I2: Incorrect variable naming due to typo<\/p>\n I3: Unused I4: Inconsistent visibility for I5: I6: I7: Unused I8: Unused function with potential data truncation risk<\/p>\n I9: Incorrect documentation<\/p>\n I10: Variables can be immutable<\/p>\n Users must trust Hyperlend not to lock funds in the protocol or manipulate token prices. Stargate gateways must be trusted to correctly relay messages between chains during cross-chain deposits.<\/p>\n Ackee Blockchain Security recommends Hyperlend to:<\/p>\n Ackee Blockchain Security<\/a>\u2019s full Hyperlend audit report can be found here<\/a><\/b>.<\/b><\/p>\n","protected":false},"excerpt":{"rendered":" Hyperlend is a lending protocol deployed on the Hyperliquid chain. The protocol implements risk-segmented lending pools designed for different use cases. The protocol\u2019s infrastructure includes cross-chain deposit endpoints for protocol pools, looping contracts that enable position management through flash loans, and helper contracts for asset listing functionality. Hyperlend engaged Ackee Blockchain Security to perform a security review of the Hyperlend protocol with…<\/p>\n","protected":false},"author":30,"featured_media":1064,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,10,103],"tags":[89,24,153],"class_list":["post-1053","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-audits","category-ethereum","category-wake","tag-audit-summary","tag-ethereum","tag-hyperlend"],"aioseo_notices":[],"featured_image_src":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2025\/06\/hyperlend-cover-600x400.png","featured_image_src_square":"https:\/\/ackee.xyz\/blog\/wp-content\/uploads\/2025\/06\/hyperlend-cover-600x600.png","author_info":{"display_name":"Tom\u00e1\u0161 Kova\u0159\u00edk","author_link":"https:\/\/ackee.xyz\/blog\/author\/tomas-kovarik\/"},"_links":{"self":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/1053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/users\/30"}],"replies":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/comments?post=1053"}],"version-history":[{"count":0,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/posts\/1053\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media\/1064"}],"wp:attachment":[{"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/media?parent=1053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/categories?post=1053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ackee.xyz\/blog\/wp-json\/wp\/v2\/tags?post=1053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\n
SCOPE<\/span><\/h2>\n
\n
425624<\/code>;<\/li>\n37c678<\/code>;<\/li>\n0fdde7<\/code>;<\/li>\n0339f1<\/code>;<\/li>\n43b101<\/code>.<\/li>\n<\/ul>\n\n
625161<\/code>;<\/li>\n0b90ce<\/code>;<\/li>\ncb6fac<\/code>;<\/li>\n4ff785<\/code>;<\/li>\n38dc8a<\/code>.<\/li>\n<\/ul>\n0c2b14<\/code>. The scope included all changes made in the src<\/code> directory compared to the original Aave v3.2 codebase.<\/p>\nFINDINGS<\/span><\/h2>\n
Critical severity<\/span><\/h3>\n
High severity<\/span><\/h3>\n
Medium severity<\/span><\/h3>\n
openPosition<\/code> function<\/p>\npayable<\/code> modifier<\/p>\nminAmountOut<\/code> calculation too restrictive<\/p>\nSafeERC20<\/code> not used<\/p>\ntransfer<\/code> revert out-of-gas<\/p>\nWalletBalanceProvider<\/code> native tokens lockup<\/p>\nLow severity<\/span><\/h3>\n
cancelTransaction<\/code><\/p>\nWarning severity<\/span><\/h3>\n
StrategyManager<\/code><\/p>\nCHAINLINK_NORMALIZATION<\/code> calculation<\/p>\nInformational severity<\/span><\/h3>\n
Ownable<\/code> inheritance<\/p>\n_reversePath<\/code> function<\/p>\ngetUserAccountData<\/code> function reverts when token price is zero<\/p>\ngetUserPairs<\/code> returns an array with empty positions<\/p>\nswapPath<\/code> parameter in SwapParams<\/code> struct<\/p>\nTRUST MODEL<\/span><\/h2>\n
CONCLUSION<\/span><\/h2>\n
\n