Smart Contract Assessment - Kickoff.fun

1. INTRODUCTION

KickOff.fun engaged Halborn to perform a security assessment of their smart contracts from February 3rd, 2026 to February 11th, 2026. The assessment scope was limited to the smart contracts provided to Halborn. Commit hashes and additional details are available in the Scope section of this report.

The KickOff.fun codebase in scope consists smart contracts that act as a liquidity bootstrapping launchpad that leverages Aerodrome's veAERO governance on the Base network.

2. ASSESSMENT SUMMARY

Halborn was allocated 7 days for this engagement and assigned 2 full-time security engineers to conduct a comprehensive review of the smart contracts within scope. The engineers are experts in blockchain and smart contract security, with advanced skills in penetration testing and smart contract exploitation, as well as extensive knowledge of multiple blockchain protocols.

The objectives of this assessment are to:

• Identify potential security vulnerabilities within the smart contracts.

• Verify that the smart contract functionality operates as intended.

In summary, Halborn identified several areas for improvement to reduce the likelihood and impact of security risks, which were partially addressed by the KickOff.fun team. The main recommendations are:

• Implement robust autopilot claim validation to prevent double benefits and ensure correct allocation on claim failures.

• Restrict pool initialization to supported tick ranges to prevent tail-tick setups that bypass price fixing and brick liquidity addition.

• Add post-swap price verification to ensure the intended price correction is achieved and prevent silent arbitrage failures.

• Disallow interactions with pre-created slipstream pools to prevent permanent denial-of-service scenarios.

• Synchronize batch indexing during emergency operations to ensure all NFTs are processed without being skipped.

• Track and isolate protocol-owned USDC balances to prevent unintended inclusion in final swap calculations.

• Apply dust deductions only when price correction occurs to prevent unnecessary liquidity reduction.

• Fix reward accounting during USDC–WETH conversions to prevent balance-donation griefing and reward manipulation.

3. TEST APPROACH AND METHODOLODY

Halborn conducted a combination of manual code review and automated security testing to balance efficiency, timeliness, practicality, and accuracy within the scope of this assessment. While manual testing is crucial for identifying flaws in logic, processes, and implementation, automated testing enhances coverage of smart contracts and quickly detects deviations from established security best practices.

The following phases and associated tools were employed throughout the term of the assessment:

• Research into the platform's architecture, purpose and use.

• Manual code review and walkthrough of smart contracts to identify any logical issues.

• Comprehensive assessment of the safety and usage of critical Solidity variables and functions within scope that could lead to arithmetic-related vulnerabilities.

• Local testing using custom scripts (Foundry).

• Fork testing against main networks (Foundry).

• Static security analysis of scoped contracts, and imported functions (Slither).