Smart Contract Assessment

Introduction#

Craftt engaged Halborn to conduct a security assessment on their smart contracts beginning on June 23rd, 2026 and ending on July 9th, 2026. The assessment scope was limited to the smart contracts provided to Halborn. Commit hashes and additional details are available in the Scope section of this report.

Following the initial assessment, the Craftt team submitted remediation updates for all identified findings. Halborn reviewed the final remediated code at commit 52e10a82d64c156904a9d227382f8ec0c18c5cff, which represents the final remediation commit for this assessment.

The reviewed contracts are an upgradeable, pending-interest lending pool for off-chain-collateralized lending. Investors deposit an ERC-20 payment token through LendingPool and receive a KYC-gated ERC20Votes share token (PoolShares), while a privileged admin transfers funds to off-chain borrowers and funds accrued interest back into investor-redeemable balances over time through partial distribute() calls. Interest accrues continuously into a separate RAY-precision pending index and is settled lazily per user via distribution epochs. The scope covers the core pool and its extensions, the share token (PoolShares), the RAY and accrual-matrix math libraries, the ERC-7201 namespaced storage layouts, the transparent-proxy factory (LendingPoolFactory), and the shared access-control, identity-registry, and ERC-2771 meta-transaction infrastructure that gate roles, KYC, and gas-relayed calls.

ASSESSMENT SUMMARY#

Halborn was provided with 13 days for this engagement and assigned a full-time security engineer to assess the security of the smart contracts in scope. The assigned engineer possesses deep expertise in blockchain and smart contract security, including hands-on experience with multiple blockchain protocols.

The objective of this assessment is to:

• Understand how the protocol works end to end and identify security issues that could affect users or pool operations.

• Follow the full investor journey, from KYC approval and deposits through interest accrual, share transfers, redemptions, and withdrawals.

• Review how defaults, writedowns, recoveries, wallet migrations, and administrative reclaims are handled.

• Confirm that balances, shares, borrowed funds, fees, yield deposits, and recovery funds remain correctly accounted for throughout the pool lifecycle.

• Assess administrative permissions, emergency controls, configuration changes, and contract upgrades.

• Test integrations such as meta-transactions, hooks, identity checks, reward distribution, and ERC-20 transfers.

• Challenge the system with rounding, timing, repeated-default, batch-processing, gas, and multi-epoch edge cases.

In summary, Halborn identified several areas for improvement to reduce the likelihood and impact of security risks, which were addressed by the Craftt team. The main recommendations were:

• Calculate recovery entitlements from historical economic balances rather than delegated voting power.

• Reject share transfers that move shares without funded value and safely handle zero-funded share-supply states.

• Block share transfers while a redemption request is outstanding or migrate the request with the position.

• Use balance snapshots or deposit cutoffs for principal distributions.

• Replace cumulative-writedown-factor flooring with a reset or guard that preserves accounting consistency.

• Use the same loss-bearing population for writedowns and subsequent recoveries.

• Retain sufficient tier history to calculate reward accrual accurately.

• Block cancellations during active redemption epochs or update the epoch denominator accordingly.

Scope#