Security patch — Cantina contest 2025-07-14

[azat-hafizov]

Findings fixed in PR (code changes)

• C478 Value Leak in rebase and distributionLoss calculation: 5aabf29
• C322 Dynamic fee calculation with incorrect parameter: 500d7bc
• C128 User can avoid redeemFee by calling redeemMulti: b6eba2f
• C524 _syncTotalSupply uses stale balances to update total supply: 9bd719c
• C441 donateD Does Not Reduce Buffer Bad Debt: 4ee1bfc
• C326 No syncRamping modifier in the rebase function: b42c750

Findings acknowledged

• C505 Fee Extraction Is Possible Via MEV Sandwich Attack
• C206 Flawed Order of Operations Leads to Mint Fee Rebate
• C475 Self Pegging Asset Contract will be DOS’d when any of the Asset Token Value is Zero

Backwards compatibility

• No storage layout changes

Artifacts

Diff link: release/cantina...develop