Fluton
Fluton Confidential DeFi Security Review
Review of Fluton’s confidential DeFi and cross-chain infrastructure, including FHE token flows, bridge integrations, and a Diamond-based Aave V3 adapter.
Kann Audits / Security Review
Wild ProtocolWild Protocol Launchpad Security Review
Review of token launch, bonding-curve, liquidity-locking, state-management, and transfer-library contracts.
- Audit period
- June 29, 2025
- Researchers
- 1 listed
- Scope
- 5 scoped paths
- Technologies
- Solidity
- Findings
- 7 documented
Executive summary
What was reviewed
Review of token launch, bonding-curve, liquidity-locking, state-management, and transfer-library contracts.
This page reflects only the scope and review context disclosed in the published report. Fields the report does not provide are omitted rather than inferred; the PDF remains the source of record for issue detail and limitations.
Security is contextual. This report does not guarantee that the protocol is free from vulnerabilities. It applies to the review context documented in the report.
Scope & record
Engagement dossier
- Researchers
- Kann
- Codebase Repository
- github.com/wildprotocol/elpee/tree/wip
- Audited commit
- 9e66614
- Technologies
- Solidity
- Category
- Launchpad
Files and paths in scope
/src/Deployer.sol/src/LpLocker.sol/src/StateManager.sol/src/libraries/CurrencySend.sol/src/libraries/CurveMath.sol
Findings overview
Severity distribution
The counts below are transcribed from the published report. Status and issue detail remain subject to that report’s exact terminology.
FINDINGS07Documented in the published report
Published findings
Findings
Findings below are reproduced from the complete Kann Audits security review. View the full PDF for complete scope, methodology, assumptions, and audit context.
High
4.1.1
LP Fees Unclaimable via launchV4Pool()
High
Description
The function launchV4Pool() allows custom pool creation and token graduation (with manually set ticks and spacing). However, it does not call lpLocker.setTokenParams(), which is required to configure the LP locker for fee claiming. Without calling setTokenParams(), fees earned from the pool become unclaimable, rendering the fee distribution logic non-functional for tokens launched via launchV4Pool(). Incontrast, thegraduateToken()functiondoesinvokelpLocker.setTokenParams(), meaningfeeclaiming only works when using that path. This makes the launchV4Pool() function incomplete and effectively useless for real-world deployments where fees matter.
Resolution
Fixed 4.2 Medium Risk
Medium
4.2.1
Bonding Curve Check stepsize * numSteps May Not Match curveSupply
Medium
Description
When launching a token with bonding curve parameters, there is no validation ensuring that stepsize * numSteps == curveSupply. If this is not aligned: If stepsize * numSteps > curveSupply, the bonding curve will appear to offer more tokens than were actually allocated, leading to potential inconsistencies (e.g., using LP pool tokens to fulfill purchases). If stepsize * numSteps < curveSupply, part of the curve supply will become unreachable via the bonding curve, and remain unused. While this behavior may be intentional to allow flexible bonding curve shapes, without an explicit check or warning, it can lead to unintended launch behavior due to misconfiguration.
4.2.2
Incorrect ETH Transfer to State Manager — Full msg.value Sent Instead of Used Amount
Medium
Description
When a user purchases a launch token using ETH (base token), the acceptAmount() function correctly calculates the amount used (amountInUsed) and refunds the excess ETH back to the user. However, despite the refund, the entire msg.value is still forwarded to the StateManager.buyToken() call, rather than just the used portion. This results in the StateManager contract receiving more ETH than it should, creating incorrect accounting and potential fund mismanagement.
4.2.3
Excess Base Tokens Not Refunded for ERC20 tokens
Medium
Description
When a user purchases tokens using an ERC20 base token, the function _getBuyQuote- AndFees()correctlycalculatestheactualamountused(amountInUsed)andtheassociatedfees. However, if the user sends more than amountInUsed, the excess tokens are not refunded. In contrast, when using ETH as the base token, any overpayment is explicitly refunded. This inconsistent behavior creates a silent loss of funds for users interacting via ERC20 tokens.
4.2.4
ERC20 Transfer — Not All Tokens Return Boolean
Medium
Description
Uses ERC20(token).transfer(...) and checks whether it returns true to confirm success. However, some widely-used tokens like USDT do not return any value on transfer, which causes the boolean check to fail and revert even if the transfer was successful.
Resolution
Fixed 4.3 Low Risk
Low
4.3.1
Forced Graduation Flag Ignored
Low
Description
Although the deployer can set allowForcedGraduation to false, graduateToken() and _launchV4Pool() do not validate this setting, allowing owner of deployer and creator to forcibly graduate a token even when it was explicitly disabled.
Resolution
Fixed 4.4 Informational
Informational
4.4.1
Missing Validation — numSteps and prices.length Mismatch
Informational
Description
In the PriceCurve bondingCurveParams, no check ensures that numSteps equals prices.length. A mismatch could result in unexpected pricing behavior or runtime errors.
Methodology
How Kann Audits reviews code
Kann Audits reports describe independent researcher review followed by collaborative analysis of findings and attack paths. The standard review foundation includes:
- 01Architecture and trust-boundary analysis
- 02Independent manual review
- 03State-transition and invariant analysis
- 04Access-control and integration review
- 05Adversarial testing and attack-path analysis
- 06Fix verification and regression review
Audit team
Researchers listed in the report
Kann
Final assessment
Documented outcome
All seven reported findings were marked fixed.
The assessment applies only to the review context and limitations documented in the published report. Missing details are not inferred, and later changes require separate analysis.
Continue reading
Related security reviews
More public work connected by protocol, category, chain, or technology.
Start a conversation
Planning your next release?
Share the system, fixed scope, and target date. Build enough time into the plan for review, remediation, and verification.