July 2026
Rebalancer and provider adapters
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 2Fixed
- Informational
- 1Fixed
Three findings, all fixed and verified by Hexens. Three days of review between the start on 14 July and the final report on 31 July 2026.
How the vaults
are secured.
Who holds the position, what each key can do, and what two public Hexens reviews found.
Two public reviews.
Findings and fixes.
Hexens reviewed the vault contracts in October 2025 and again after the July 2026 update. Each report names the exact code it reviewed and the commit with the fixes.
Read the report
October 2025
Automated interest rebalancing protocol
- Critical
- 0
- High
- 0
- Medium
- 2Fixed
- Low
- 1Fixed
- Informational
- 3Acknowledged
Six findings. The two medium and one low finding were fixed; the three informational items were acknowledged. Four days of review, 20 to 30 October 2025.
Every role
has a boundary.
Holding the position, allocating the capital and changing the configuration are distinct parts of the system.
Position ownershipWith the
shareholder.
shareholder.
Vault shares remain the ownership record as allocation changes underneath.
Shareholder
Own the position.
Holds vault shares and authorises a redemption directly or through an approved allowance.
Executor
Manage allocation.
Moves assets between approved lending providers. Rebalancing changes the underlying allocation without reissuing customer shares.
Timelock
Control provider changes.
Changes to the provider list pass through the timelock, separating configuration changes from day-to-day allocation.
Administrator
Operate defined controls.
Manages vault parameters and separate pause controls for deposits and withdrawals. These permissions form part of the technical review.
The questions
behind the decision.
Start with the vault your customers will use: its code, assets, permissions and operating model.
What do the audits cover?
Hexens reviewed the automated interest rebalancing protocol in October 2025 and the updated rebalancer with its provider adapters in July 2026. Each report covers a specific commit, listed above with the commit that contains the fixes. Code outside those commits is not covered.
How is the position represented?
The protocol uses ERC-4626 vault shares. These account for a proportional claim on the underlying assets; their value can change as the vault’s assets change.
What risks should a product team consider?
Smart contracts, lending markets, stablecoins and network conditions can affect value and liquidity. An audit helps assess a defined code scope; it does not guarantee returns or eliminate these risks.
What do we discuss before an integration?
The proposed vault and code version, supported assets, contract roles, deposits and withdrawals, fees, monitoring and responsibilities across the two teams.