Security Notes
This section describes security controls and residual risks for the V2 architecture used by Ethereum Network Lending, AAVE GHO Saving, and Hyperliquidity Provider (HLP). It is not an independent audit report or a guarantee of fund safety. AAVE GHO Staking uses a separate V3 architecture and is hidden from the public mainnet frontend; the V2 Guardian, pause, shutdown, and share-accounting model must not be applied to it.
| Area | Note |
|---|---|
| Upgradeability | The Controller and HyperCoreAllocator use UUPS upgradeability and ERC-7201 namespaced storage. Namespacing reduces accidental storage-slot overlap; it does not guarantee upgrade safety. Each upgrade requires authorization checks, storage-layout compatibility review, and tests against the deployed implementation. Effective upgrade authority must be checked against each contract's implementation and current role grants. |
| Reentrancy | The documented V2 withdrawal, async claim, and emergency redemption paths use reentrancy guards. Review must also cover cross-function state changes, external token/strategy calls, and the deployed implementation; a modifier alone is not proof that every capital-movement path is safe. |
| Emergency Design | A successful shutdown() permanently disables normal vault deposit/withdraw flows and enables emergency redemption. Recovery is limited to available vault assets, not a guarantee of full principal repayment. HLP assets on HyperEVM/HyperCore require the separate reverse-allocation and CCTP return flow before becoming Ethereum vault liquidity. See the emergency workflow. |
| Strategy Failure Isolation | The documented liquidity waterfall retries remaining strategies after failed replenish() calls. Withdrawals can still revert if the remaining accessible liquidity cannot cover the shortage. External protocol pauses, route failure, and asynchronous cross-chain assets can prevent immediate recovery. |
| Cross-chain State | To prevent spoofing, HyperStrategy only processes state updates matching the expected CCTP source domain and the registered HyperCoreAllocator sender. |
| Fee Minting | The V2 fee-share mechanism depends on confirmation of a profitable NAV epoch and a non-zero configured fee. All three V2 portal rates were 0% at Ethereum block 25887436 (2026-09-02 05:12:27 UTC), so the fee-share mechanism is inactive at that configuration. The rate remains configurable; confirm current on-chain values before operation. |
| Harvest Protection | The documented V2 harvest restriction protects the vault's underlying asset and share token while active and for 7 days after shutdown. The time limit does not guarantee that all investors have redeemed or all strategy assets have returned. After it expires, authorized harvesting can remove remaining assets; recovery sequencing and user communication are required. |
AAVE GHO Saving Risks
The sGHO base savings rate is variable, not a fixed APY. Saving remains exposed to GHO/USDC peg movements, stablecoin issuer and smart-contract risks. Redeeming sGHO to GHO does not itself complete a King's Vault withdrawal to USDC: the final amount and availability depend on vault liquidity, conversion-route capacity, execution-time quotes, and successful contract execution.
The current sGHO savings design has no Umbrella staking cooldown or slashing mechanism, but this is not a principal guarantee or a promise of immediate USDC withdrawal. See the AAVE GHO Saving introduction for the product's yield, accounting, and fee treatment.
Scope and Remaining Verification
These notes describe the V2 controls, not completed security-test results. Aave/GHO, Morpho, Hyperliquid, token issuers, conversion routes, and CCTP introduce their own contract, liquidity, operational, and governance risks. In particular, a strategy's reported value is not necessarily immediately withdrawable USDC.
Use the deployment verification status to distinguish published addresses from a verified source/permissions manifest. The Slither and Mythril pages describe analysis scope and methodology; they do not establish that the deployed products have passed an independent audit.