Skip to content
Fuga Labs
Scope an engagement
Sector preset

DeFi protocols

For protocols whose contracts passed, and whose oracle, admin key and eighteen-month-old approval were never in scope.

Scope an engagement Every sector preset
PresetonboardDefiProtocolDetectors in play13Boundaries declared3Refusals at onboarding0

How this sector loses money.

Your audit certified the code as written. It did not certify the oracle you read, the admin key that can replace the implementation, the timelock somebody shortened last quarter, or the approval a contributor granted eighteen months ago and never revoked. Every one is a live path into a contract that passed.

Answered by
  • 9Deterministic rules
  • 2Invariants
  • 1Simulation
  • 1Models

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardDefiProtocol(platform, config) 7 configured
  1. 01Archetype-specific invariants: lending, AMM or vault, declared at onboarding
  2. 02Atomic value conservation across declared holders, with an explicit fee tolerance
  3. 03State invariants on oracles and on every value the protocol treats as authoritative
  4. 04Full authority surface: admin changes, EOA role grants, upgrade diffs, uninitialised proxies, critical selectors
  5. 05Timelock hygiene: queued critical actions, delay reductions, and bypass
  6. 06Drainer-outcome simulation on forked state, before inclusion
  7. 07A guardian circuit-breaker module you deploy, own and can revoke
Detectors in play
  • inv.atomic-value-conservation
  • invariants.state
  • rules.reentrancy
  • rules.upgrade-implementation-diff
  • rules.uninitialized-proxy
  • rules.admin-authority-change
  • rules.role-granted-to-eoa
  • rules.critical-selector
  • rules.timelock-critical-action-queued
  • rules.timelock-delay-reduced
  • rules.timelock-bypass
  • sim.drainer-outcome
  • ml.fundflow-anomaly

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge Governance forums, Discord and social consensus are not on chain.
Closed by Closed by payload simulation. Fuga Labs judges what a proposal EXECUTES on forked state, not what its title or its forum thread claims, which is precisely the gap the Bybit signers fell through.
The edge A contract can be mathematically correct and economically wrong.
Closed by Closed by invariants you declare plus atomic value conservation, which does not care whether the call was authorised, only whether value left that should not have.
The edge A Circuit Breaker should never be armed on the strength of a demo.
Closed by Closed by staging it. The breaker ships disarmed and runs report-only against your live traffic, writing to a durable shadow ledger until the duration, volume and distinct-subject coverage clear the bar you set. You arm it. You can revoke it at any block.

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

  1. Step 1

    Scope

    The archetype is declared, never guessed: lending, AMM or vault. It decides what correct means, and with it the holder set for value conservation and the fee tolerance that separates a swap from a drain.

  2. Step 2

    Detect

    The invariants you declared run every block, and a proposal is judged on what it executes against forked state, not on what its forum thread claims. Value conservation does not care whether the call was authorised.

  3. Step 3

    Prevent

    The guardian module is yours: you deploy it, you own it, you revoke it in one transaction. Its one pre-authorised action, pausing a named market, is fixed before anything is armed.

What runs underneath.

The customer-owned breaker is the piece that changes your worst hour, because a finding you cannot act on is a receipt with better timing.

The base under all eleven presets

Scope DeFi protocols coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset