centrifuge-v3

centrifuge-v3

@centrifuge
Live

Maximum reward

$250,000

Severity

Max. Reward

Critical

$250,000

High

$50,000

Medium

$5,000

Findings submitted

24

Start date

17 Jul 2025

Please sign in as a researcher to join the bounty.

Log in
InstructionsScope

In scope

Core Contracts

Severity

Min and Max Reward

Critical

Up to $250,000

High

Up to $50,000

Medium

Up to $5,000

Centrifuge V3 operates on a hub-and-spoke model. Each pool chooses a single hub chain, and can tokenize and manage liquidity on many spoke chains.

Asset
Description
https://github.com/centrifuge/protocol-v3/releases/tag/v3Centrifuge V3

Out of scope

  • Everything from previous V3 audits: https://github.com/centrifuge/protocol-v3/tree/main/docs/audits
  • Hub and Balance Sheet Managers are fully trusted ⇒ any issue caused by misuse from the manager is invalid
  • Griefing issue on Hub.createPool
  • Any issue related to arbitrage between different assets/currencies in the same pool. Solved by using identity valuation.
  • Issues related to cross-chain messages not being executed for a long time, in the wrong order or create race-conditions
  • Exception: Loss of tokens
  • GasService estimate is under/overestimated.
  • Subsidized funds can be spammed: we will add min investment limits to alleviate this.
  • AsyncRequest._withdraw() using current pricePoolPerAsset which is potentially unlikely pricePoolPerAsset during approval of redemption - see
  • Only deployed on chains with Cancun EVM support. And no zksync.
  • No fee-on-transfer, ERC777 callbacks, or rebasing tokens
  • After Root.relySchedule executes, the timelock does not apply anymore => intentional, combined with spell pattern it works
  • Guardian only works with Safe, if the admin is not a Safe the pause can only be executed by the full Safe and not individual owners
  • Liquidity can be stuck if a user is frozen
  • Liquidity can be stuck if all vaults are unlinked
  • While paused, users can still claim assets/shares
  • Auth pattern does not check that there is at least 1 ward
  • Manager needs to ensure hooks across domains are compatible
  • User needs to ensure they transfer valid share tokens eg member