Sherlock bug bounty · $150K max · 23 agents · May 14, 2026
| ID | Finding | Severity | Rating | Confidence | Verification | Submit |
|---|---|---|---|---|---|---|
| S-02 | HyperliquidUsdcOracle ETH_INDEX=4 is DYDX, not ETH (15,000x overvaluation) | Critical | 10/10 | 99% | Mainnet API | YES |
| S-04 | RedstoneOracle ms/seconds mismatch, staleness check 100% broken | High | 9/10 | 95% | Source Code | YES |
| S-01 | AggV3Oracle missing negative/zero price check (pattern gap vs sister contracts) | Medium | 8/10 | 99% | Forge 6/6 | YES |
| S-03 | Hyperliquid Oracle zero price validation missing (division by zero DoS) | Medium | 7/10 | 90% | Pattern Match | YES |
| S-05 | SuperPool cannot force-remove paused pool (funds locked) | Medium | 6/10 | 80% | Logical | MAYBE |
ETH_INDEX = 4 in HyperliquidUsdcOracle.sol, but index 4 on Hyperliquid mainnet is DYDX ($0.15), not ETH ($2,269).
getValueInEth() divides the USDC amount by the DYDX price instead of the ETH price. That's a 15,127x overvaluation of USDC collateral, which opens unlimited undercollateralized borrowing and drives the protocol insolvent.
Confirmed across 4 independent sources. The Hyperliquid mainnet API (meta endpoint), metaAndAssetCtxs live prices, the on-chain precompile at 0x0806, and the official GitHub repo all agree.
HyperliquidOracle.sol gets it right with ETH_INDEX = 1.
getOracleNumericValuesAndTimestampFromTxMsg() returns the timestamp in milliseconds. It gets stored raw as priceTimestamp, then compared against block.timestamp (seconds) in the staleness check.
priceTimestamp (~1.7 trillion) is always greater than block.timestamp - 3600 (~1.7 billion). So the staleness check never triggers and arbitrarily stale prices sail through.
Redstone source code shows RedstoneDefaultsLib.validateTimestamp(uint256 receivedTimestampMilliseconds) dividing by 1000 on purpose. Sentinel V2's prior audited version used block.timestamp directly, so this is a regression introduced after the audit.
_getPrice() casts int256 answer to uint256 without checking answer <= 0. The sister contracts ChainlinkEthOracle (L116) and ChainlinkUsdOracle (L135) both check it.
A zero price values the asset at 0, which triggers unfair liquidation. A negative price causes an arithmetic panic, which is a DoS. No graceful error handling either way.
VerificationForge PoC passes 6 of 6 tests. For audit precedent, see Sherlock WooFi #22 (Medium) and C4 Juicebox #78 (Medium).
| Metric | C5 | C6 |
|---|---|---|
| Agents | 8 | 23 |
| Tokens | 550K | 1.55M |
| Findings | 2-5 | 4-5 |
| Raw EV | $9K | $5.6-18.7K |
| Forge PoC | No | Yes |
| X-Contract | No | Yes |