Pulse In Private
Pulse In Private Security Review — March 2025
Review of the Pip contract and withdrawal circuit, covering recovery of stuck funds and relayer-fee configuration.
Kann Audits / Security Review
Pulse In PrivatePulse In Private Security Review — April 2025
Second review of the private-withdrawal contract and circuit, focused on relayer request validation and fee visibility.
- Audit period
- April 3, 2025
- Researchers
- 2 listed
- Scope
- 2 scoped paths
- Technologies
- Solidity, Circom
- Findings
- 2 documented
Executive summary
What was reviewed
Second review of the private-withdrawal contract and circuit, focused on relayer request validation and fee visibility.
This page reflects only the scope and review context disclosed in the published report. Fields the report does not provide are omitted rather than inferred; the PDF remains the source of record for issue detail and limitations.
Security is contextual. This report does not guarantee that the protocol is free from vulnerabilities. It applies to the review context documented in the report.
Scope & record
Engagement dossier
- Researchers
- Kann, Ivan Fitro
- Codebase Repository
- github.com/alexbabits/pip
- Audited commit
- b7234af
- Technologies
- Solidity, Circom
- Category
- DeFi Privacy
Files and paths in scope
/src/Pip.sol/circuits/height12/withdraw.circom
Findings overview
Severity distribution
The counts below are transcribed from the published report. Status and issue detail remain subject to that report’s exact terminology.
FINDINGS02Documented in the published report
Published findings
Findings
Findings below are reproduced from the complete Kann Audits security review. View the full PDF for complete scope, methodology, assumptions, and audit context.
Informational
6.1.1
Add Off-Chain Checks for requestWithdraw to Prevent Spam with Invalid Proofs and Potential Gas Waste for Relayers
Informational
Description
Inthe requestWithdrawprocess, users submita withdrawalrequestby providingaproof and public signals which get sent in a Telegram group. Relayers monitor this group and use the provided information to call the on-chain withdraw function. However, without proper off-chain validation, bad actors can flood the Telegram group with invalid or duplicate requests, causing relayers to waste gas attempting failed transactions.
Recommendation
To prevent this, off-chain validation should include: Nullifier Existence – Ensuring the provided nullifier corresponds to a valid deposit. Correct Recipient – Verifying that the recipient address matches the expected one for the nullifier. Withdrawal Status – Checking if the nullifier has already been used for a withdrawal.
6.1.2
Add an On-Chain View Function for Relayers to Estimate Exact Fee Rewards
Informational
Description
Currently, relayers calling the withdraw function lack an efficient way to determine the exact fee they will receive for processing a withdrawal. This uncertainty may discourage participation or lead to inefficient relaying strategies.
Recommendation
To address this, an on-chain view function should be implemented to allow relayers to see the exact fee amount they will receive before executing a withdrawal transaction.
Methodology
How Kann Audits reviews code
Kann Audits reports describe independent researcher review followed by collaborative analysis of findings and attack paths. The standard review foundation includes:
- 01Architecture and trust-boundary analysis
- 02Independent manual review
- 03State-transition and invariant analysis
- 04Access-control and integration review
- 05Adversarial testing and attack-path analysis
- 06Fix verification and regression review
Audit team
Researchers listed in the report
KannIvan Fitro
Final assessment
Documented outcome
Both informational findings were marked fixed.
The assessment applies only to the review context and limitations documented in the published report. Missing details are not inferred, and later changes require separate analysis.
Continue reading
Related security reviews
More public work connected by protocol, category, chain, or technology.
Fluton
Fluton Confidential DeFi Security Review
Review of Fluton’s confidential DeFi and cross-chain infrastructure, including FHE token flows, bridge integrations, and a Diamond-based Aave V3 adapter.
N4A
N4A Bounty Program Security Review
Review of eight Solidity contracts implementing on-chain bounty programs, escrow, report adjudication, disputes, and payouts.
Start a conversation
Planning your next release?
Share the system, fixed scope, and target date. Build enough time into the plan for review, remediation, and verification.