Protocol
Security model.
What the contracts can and cannot do, how they are tested, and admin powers.
What the ladder managers can do with your funds, what they cannot, and how they were tested.
Not audited yet
The Obol contracts have not been through an external security audit. They are covered by fork tests against live Uniswap pools, but you should treat them as experimental and only deposit what you can afford to lose.
Guarantees in the code
- Only the owner can claim or close a ladder, and funds always go to the owner (minus the protocol fee on fees).
- No admin withdrawal. There is no function that lets anyone else move liquidity or tokens held for a ladder.
- No upgrades, no pause. The contracts are not proxies; their code cannot change.
- Bounded spending. An open never spends more than the caller sent; leftovers are refunded in the same transaction.
- Price guard. Opens revert if the price moved beyond your slippage, which defeats sandwich attacks on liquidity adds.
- Canonical pools only (V3). Pools must come from the Uniswap V3 factory.
- Reentrancy protection on every state-changing function; the V4 callback only accepts calls from the PoolManager.
Admin powers
| Function | Who | Effect |
|---|---|---|
setTreasury(address) | Contract owner | Changes where the 7.5% protocol fee is sent. Nothing else. |
The protocol fee rate itself is a constant and cannot be raised.
Testing
Both managers are covered by Foundry tests that run against a fork of Robinhood Chain mainnet, using real Uniswap pools:
- Single-sided opens on token0 and token1, with native ETH and with ERC-20s.
- Full cycles: open, real swaps through the ladder, fee claim, close; balances, refunds and fee amounts checked.
- Protocol fee taken on fees only, including on close.
- Rejections: wrong ETH value, price guard, non-owner actions, non-Uniswap pools, ranges with no usable bins.
Audit status
No external audit has been completed yet. This page will link to the report once one is published.
Found a bug?
Please report it privately to @obolfi before disclosing it publicly.
