Asymmetry / USDaf-v2

USDaf a licensced Liquity v2 fork with wBTC, tBTC, scrvUSD, ysyBOLD, sfrxUSD, and sUSDS as collaterals. USDaf is a CDP and immutable by design. Users can deposit any of these assets and borrow USDaf against them, while setting their own custom fixed interest rates.

Prize distribution and scoring

• Total Public Prize Pool: $70,000

• Primary Pool:$65,000

• Dedicated researcher pool: $15,000

• $5,000 of the prize pot is reserved for Low Severity & Informational: findings. These reports are judged based on quality and reviewers are then ranked from 1st to 5th for the purpose of prize allocation.

  • 1st: $2.5k
  • 2nd: $1.25k
  • 3rd: $750
  • 4th: $250
  • 5th: $250

• Scoring described in the competition scoring page.

• Findings Severities described in detail on our docs page.

Documentation

All changes in the PR under Files are in scope. No parts of the underlying Liquity codebase are in scope.

USDaf replaces ETH, wstETH, and rETH with wBTC, tBTC, scrvUSD, ysyBOLD, sUSDS, and sfrxUSD. Chainlink feeds are used as the primary feeds for all collaterals, with Curve fallback oracle feeds for some.

Additional information regarding ysyBOLD oracle: USDaf v2 Oracle Setups and Rationale

Scope

In Scope

• Repository:
  • https://github.com/asymmetryfinance/USDaf-v2/
• Commit: c51caef00ccd2d42ec7ed569009e53e7537d1546
• Files:
  • Only files modified here or files impacted by these changes are in scope.
    • https://github.com/liquity/bold/compare/main...asymmetryfinance:USDaf-v2:main

Out of Scope

• Files:

  • contracts/src/PriceFeeds/USDaf/CbbtcOracle.sol
  • contracts/src/PriceFeeds/USDaf/Fallbacks/CbbtcFallbackOracle.sol
  • contracts/src/PriceFeeds/USDaf/SusdeOracle.sol
  • contracts/src/PriceFeeds/USDaf/SdaiOracle.sol

• Previous security reports

  • https://reports.electisec.com/2025-01-Asymmetry-USA-d
  • https://reports.electisec.com/2025-05-Asymmetry-USDaf-V2
  • https://reports.electisec.com/2025-06-usdaf-2-pr2
  • https://drive.google.com/file/d/1jx9R6UCiAH8v8dJhQCac8Kawwaf8toft/view?usp=sharing

• Expected behaviors

  • ysyBOLD oracle risk is acceptable
    • USDaf v2 Oracle Setups and Rationale

• Automated findings by LightChaser

  • https://gist.github.com/ChaseTheLight01/9567daacea79e92391687fc87ff13f72

Build Instructions

• Forge build

Basic POC Test

Mandatory POC rule applies for this competition

Contact Us

For any issues or concerns regarding this competition, please reach out to the Cantina core team through the Cantina Discord.