MantleMegaVaultStressTest_Suite__3_contracts_

Mantle Mainnet · scan depth full-report · generated 6/16/2026, 12:02:25 AM

Risk Score

100

Archon completed a read-only Mantle Mainnet audit of MantleMegaVaultStressTest_Suite__3_contracts_ and found 98 deterministic findings. The highest-priority issue is Weak Prng, with risk score 100/100 based on severity-weighted findings. The function weakRandomBonus uses block properties that can be influenced by miners, making it unsuitable for generating secure randomness. Review the recommended fixes and run regression tests before deployment.

Findings

low: 30high: 10info: 46medium: 12critical: 0

Public validation

Challenge ledger

Anyone can challenge this artifact. Archon records the challenge in the database with a deterministic hash and references any existing report proof tx/hash. No new validation contract is implied.

No challenges recorded yet.

Proof Verification

Stored report hash

0xcfa9b28e9965b5aeae89f48ac2a997331a16572a8bee8e9f654acbb02ffd616d

Re-derived hash

0xcfa9b28e9965b5aeae89f48ac2a997331a16572a8bee8e9f654acbb02ffd616d

Metadata URI

ipfs://Qmbgb9Zk2kBUGQb1jFhb8Y75eEFL4SA4taCiW7LH9zpNZz

Result

Hash match + ERC-8004 on-chain attestation present

Mantlescan

ERC-8004 Reference

{
  "author": "0x99186e9a933fd83c0813d7ee694464ca55aeb7f9",
  "agentId": "97",
  "contract": "0xe7043e2ec95eF357FbBa3359BA2f1edb10cEAD2a",
  "loggedBy": "0x99186e9a933fd83c0813d7ee694464ca55aeb7f9",
  "mechanism": "archon-proof-registry",
  "reputation": {
    "tag2": "risk:100",
    "txHash": "0xa33888facada0e654e6370f851d8650566e4ff7d11e395978b868591c207e3f3",
    "agentId": "97",
    "feedbackIndex": "9",
    "feedbackClient": "0x8cd94bc5Ce29ECDA7feDbc14D264873835284D79",
    "reputationRegistry": "0x8004BAa17C55a88189AE136b182e5fdA19dE9b63"
  }
}

Careful scope

Archon reports are risk intelligence with confidence scores and recommended fixes. They are not guarantees, certifications, or claims that a contract is safe.

Severity	Finding	Location	Confidence
high	Weak Prng The function weakRandomBonus uses block properties that can be influenced by miners, making it unsuitable for generating secure randomness.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:634	70%
high	Controlled Delegatecall The adminDelegateCall function allows for delegate calls to arbitrary contracts, which can lead to storage manipulation.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:289	80%
high	Unchecked Transfer The withdrawWithHook function performs an external call before updating the state, which can lead to reentrancy vulnerabilities.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:430	90%
high	Unchecked Transfer The weakRandomBonus function is susceptible to manipulation due to reliance on block properties.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:634	70%
high	Unchecked Transfer The withdraw function performs an external transfer before updating the state, which can lead to reentrancy vulnerabilities.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:404	90%
high	Unchecked Transfer The function claimAirdropWithSig does not check the return value of the token transfer, which can lead to unexpected behavior if the token transfer fails.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:574	80%
high	Unchecked Transfer The function sweepTokenByOrigin ignores the return value of the token transfer, which may lead to loss of funds if the transfer fails.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:261	75%
high	Unchecked Transfer The claimRewards function does not check the return value of the token transfer, which can lead to reentrancy issues with malicious tokens.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:381	85%
high	Unchecked Transfer The deposit function does not check the return value of the token transfer, which can lead to unexpected behavior if the transfer fails.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:303	70%
medium	Reentrancy No Eth Reentrancy No Eth was detected from deterministic analysis at MantleMegaVaultStressTest_Suite__3_contracts_.sol:381-397. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:381	74%
medium	Reentrancy No Eth The withdrawWithHook function allows for an external call before the state is updated, which can lead to reentrancy attacks.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:430	70%
medium	Reentrancy No Eth The withdraw function performs an external call before updating the state, which can lead to reentrancy vulnerabilities.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:404	70%
medium	Tx Origin The sweepTokenByOrigin function uses tx.origin for authorization, which can lead to security issues.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:261	60%
medium	Unused Return The userCollateralValue function reads latestTimestamp but does not validate it, which could lead to incorrect assumptions about data freshness.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:607	50%
low	Events Access The transferOwnership function allows ownership transfer without proper checks, which can lead to loss of ownership.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:238	60%
low	Events Maths The function setProtocolFeeBps allows the owner to set a new protocol fee without any bounds checking.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:229	70%
low	Events Maths The function setRewardRatePerSecond allows the owner to set a new reward rate without validation.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:220	70%
low	Missing Zero Check The withdrawWithHook function does not check if positionId is valid or if the hook address is non-zero.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:430	80%
low	Missing Zero Check The constructor does not validate the addresses provided for _mntToken, _oracle, and _treasury.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:187	80%
low	Missing Zero Check The adminDelegateCall function does not validate the target address.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:289	80%
low	Missing Zero Check The adminCall function lacks a check for zero addresses, which could lead to unintended behavior if a zero address is passed.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:274	70%
low	Missing Zero Check The transferOwnership function does not check for a zero address, which could lead to ownership being transferred to an invalid address.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:238	70%
low	Missing Zero Check The setTreasury function lacks a check for zero addresses, which could lead to issues if a zero address is set as the treasury.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:212	70%
low	Missing Zero Check The setOracleUnsafe function does not check for a zero address, which could lead to the oracle being set to an invalid address.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:247	70%
low	Calls Loop The withdraw function performs an external call before updating the state, which can lead to reentrancy vulnerabilities.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:404	80%
low	Reentrancy Benign The deposit function ignores the return value of the token transfer, which can lead to unexpected behavior if the transfer fails.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:303	70%
low	Reentrancy Benign The claimRewards function does not check the return value of the token transfer, which could lead to issues if the transfer fails.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:381	70%
low	Reentrancy Events The weakRandomBonus function uses block variables that can be influenced by miners, which may lead to predictable outcomes.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:634	60%
low	Reentrancy Events The sweepTokenByOrigin function ignores the return value of the token transfer, which can lead to issues if the transfer fails.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:303	70%
low	Reentrancy Events The deposit function ignores the return value of the token transfer, which can lead to unexpected behavior if the transfer fails.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:261	70%
low	Reentrancy Events The function executeStrategy uses delegatecall or call to execute external strategies, which may lead to reentrancy vulnerabilities if the target contract is not trusted.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:694	70%
low	Reentrancy Events The withdraw function transfers tokens before updating the position state, which can lead to reentrancy attacks.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:404	80%
low	Reentrancy Events The claimRewards function transfers rewards before updating the position state, which can lead to reentrancy vulnerabilities.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:381	75%
low	Reentrancy Events The withdrawWithHook function allows for an external hook call before updating the position state, which can lead to reentrancy attacks.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:430	80%
low	Timestamp The updateManyNotes function does not have any checks against excessive gas consumption or unbounded loops.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:464	60%
low	Timestamp External call before state update can lead to reentrancy vulnerabilities.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:404	80%
low	Timestamp External call before state update can lead to reentrancy vulnerabilities.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:381	80%
low	Timestamp External call before state update can lead to reentrancy vulnerabilities.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:430	80%
info	Costly Loop Costly Loop was detected from deterministic analysis at MantleMegaVaultStressTest_Suite__3_contracts_.sol:523-558. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:523	74%
info	Costly Loop Costly Loop was detected from deterministic analysis at MantleMegaVaultStressTest_Suite__3_contracts_.sol:745-761. The issue should be reviewed because it can affect contract correctness, user balances, or operational cost depending on how the function is used.	MantleMegaVaultStressTest_Suite__3_contracts_.sol:745	74%