Smart Contracts - Alula Finance

1. INTRODUCTION

Alula Finance engaged Halborn to conduct a security assessment on their smart contracts beginning on December 30th, 2025 and ending on February 5th, 2026. The security assessment was scoped to smart contracts in the GitHub repository provided to the Halborn team. Commit hashes and further details can be found in the Scope section of this report.

2. ASSESSMENT SUMMARY

The team at Halborn assigned a full-time security engineer to assess the security of the smart contracts. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract hacking, and deep knowledge of multiple blockchain protocols.

The purpose of this assessment is to:

• Ensure that smart contract functions operate as intended.

• Identify potential security issues with the smart contracts.

In summary, Halborn identified some improvements to reduce the likelihood and impact of risks, which were mostly addressed by the Alula Finance team. The main ones were the following:

• Prevent the pool balance from increasing without a proportional issuance of ownership shares, ensuring that every nonzero contribution results in a corresponding share allocation and avoiding scenarios where contributors receive no ownership.

• Ensure that the pool balance is decremented by the exact amount of distributed take rate fees whenever fees are paid out.

• Ensure that collateral and debt values are always normalized to a consistent internal scale before any health, utilization or liquidation logic is applied.

• Restrict market state changes to explicitly authorized actors, requiring approval from a privileged role such as protocol administration or governance before allowing any update to the market state.

• Ensure that referrer incentives are fully accounted for by consistently calculating and transferring the corresponding amounts whenever referral fees are charged and by validating that such fees always result in an actual payout.

• Update pool liquidity accounting consistently during debt repayment in liquidation.

• Require explicit consent from the intended recipient before executing any flash loan, guaranteeing that the receiver has approved the operation or the initiating party and preventing third parties from triggering flash loans without authorization.

• Ensure that the oracle price is strictly greater than zero and revert execution when a zero price is returned.

• Avoid using spot reserve ratios as an oracle output for value sensitive decisions.