Kann Audits
View Audits Talk to an Expert

Kann Audits / Security Review

Pulse In Private

Pulse In Private Security Review — March 2025

Review of the Pip contract and withdrawal circuit, covering recovery of stuck funds and relayer-fee configuration.

SolidityCircomMarch 28, 2025
Download Report Open Report Codebase Repository
Audit period
March 28, 2025
Researchers
2 listed
Scope
2 scoped paths
Technologies
Solidity, Circom
Findings
2 documented

Executive summary

What was reviewed

Review of the Pip contract and withdrawal circuit, covering recovery of stuck funds and relayer-fee configuration.

This page reflects only the scope and review context disclosed in the published report. Fields the report does not provide are omitted rather than inferred; the PDF remains the source of record for issue detail and limitations.

Security is contextual. This report does not guarantee that the protocol is free from vulnerabilities. It applies to the review context documented in the report.

Scope & record

Engagement dossier

Researchers
Kann, Ivan Fitro
Codebase Repository
github.com/alexbabits/pip
Audited commit
ce32639
Technologies
Solidity, Circom
Category
DeFi Privacy

Files and paths in scope

  • /src/Pip.sol
  • /circuits/height12/withdraw.circom

Findings overview

Severity distribution

The counts below are transcribed from the published report. Status and issue detail remain subject to that report’s exact terminology.

FINDINGS02Documented in the published report
Medium: 2
SeverityCount
Critical0
High0
Medium2
Low0
Informational0

Published findings

Findings

Findings below are reproduced from the complete Kann Audits security review. View the full PDF for complete scope, methodology, assumptions, and audit context.

Medium

2 findings
6.1.1

Rescue Tokens: Implement a Rescue Funds Function for stucked funds

Medium
Description

In Pip.sol, when a user deposits, they receive a nullifier code which is required when withdrawing from a different address. However, since it is possible for a user to forget their nullifier code, the funds could become permanently stuck in the contract.

Recommendation

Add a rescueFunds function along with an on-chain view function to check whether the nullifier hash (used during withdrawal) has been consumed. This would enable the protocol to verify that the user genuinely forgot their nullifier code and facilitate the recovery of their funds.

StatusAcknowledged

Link to this finding
6.1.2

Constant Fee for Relayer

Medium
Description

Gas consumption on the chain could increase—either temporarily during high congestion periods or permanently due to evolving network conditions. With the current fixed fee parameters, relayersmaynotreceivesufficientincentivestocovertheirgasexpenses. Insomecases, arelayer might end up paying more in gas fees than the reward they receive. This imbalance not only discourages relayer participation but also forces new addresses to source gas from elsewhere in order to call the withdraw() function, which negatively impacts the protocol’s overall usability and efficiency.

Recommendation

User-Defined Relayer Fee: Allow users to input a custom relayer fee when initiating a transaction. This approach gives users the flexibility to determine what they consider a fair incentive for the relayer, based on current network conditions and their own willingness to pay. Dynamic Gas Fee Function: Alternatively, implement a function that can adjust the gas fee for relayers. This function would allow the protocol administrator (or even potentially the community through governance mechanisms) to update the relayer fee dynamically in response to changes in gas prices. This ensures that the fee remains competitive and sufficient to cover relayer costs.

StatusFixed

Link to this finding

Methodology

How Kann Audits reviews code

Kann Audits reports describe independent researcher review followed by collaborative analysis of findings and attack paths. The standard review foundation includes:

  1. 01Architecture and trust-boundary analysis
  2. 02Independent manual review
  3. 03State-transition and invariant analysis
  4. 04Access-control and integration review
  5. 05Adversarial testing and attack-path analysis
  6. 06Fix verification and regression review

Audit team

Researchers listed in the report

KannIvan Fitro

Final assessment

Documented outcome

One medium finding was fixed and the other was acknowledged.

The assessment applies only to the review context and limitations documented in the published report. Missing details are not inferred, and later changes require separate analysis.

Download Full PDF Open Report Explore Smart Contract Security Audits

Continue reading

More public work connected by protocol, category, chain, or technology.

All reports

Start a conversation

Planning your next release?

Share the system, fixed scope, and target date. Build enough time into the plan for review, remediation, and verification.

Talk to an Expert View Audits