KiteNativeOFTAdapter - Kite

1. INTRODUCTION

Halborn was engaged to conduct a security assessment of the Kite protocol. The assessment was performed on March 2nd, 2026. Commit hashes and additional implementation details reviewed during the engagement are documented in the Scope section of this report.

The Kite protocol implements a cross-chain bridging mechanism built on LayerZero’s OFT standard, enabling transfers of native KITE across multiple networks while maintaining total supply consistency. The system uses a NativeOFTAdapter to lock native KITE on the source chain and mint corresponding tokens on destination chains. It incorporates a configurable daily outbound limit, exemption controls, a capped deposit-to-lock model aligned with the 10B maximum supply, and pause functionality to manage risk and protect user funds.

2. ASSESSMENT SUMMARY

A full-time security engineer from Halborn conducted a targeted security review of the Kite protocol. The assessment was performed by a blockchain and smart contract security specialist with expertise in DeFi yield strategies, tokenized vault designs, and reward distribution mechanisms.

The purpose of the assessment was to:

• Identify potential security, economic, and design issues within the Kite smart contracts.

• Verify that deposit, withdrawal, harvesting, and reward distribution workflows operate as intended under various market and usage scenarios.

In summary, Halborn identified some improvements to reduce the likelihood and impact of risks, which were partially addressed by the Kite team. The main recommendations included:

• Implemented daily outbound limit tracking based on the actual debited token amount rather than user-supplied input, preventing inaccurate volume accounting.

• Enforced deposit caps within the protocol’s accounting logic to prevent cap bypass through direct token transfers.

• Restricted depositToLock execution while the protocol is paused to ensure pause protections are consistently applied.

• Validated daily limit reductions against the current usage to prevent underflow conditions and unintended denial-of-service scenarios.

3. TEST APPROACH AND METHODOLOGY

Halborn performed a combination of manual code review and automated security testing to balance efficiency, timeliness, practicality, and accuracy in regard to the scope of this assessment. While manual testing is essential to uncover flaws in logic, process, and implementation, automated testing techniques enhance coverage of smart contracts and can quickly identify issues that do not follow security best practices.

The following phases and associated tools were used throughout the assessment:

• Research into the architecture, purpose, and use of the platform.

• Manual code review and walkthrough of the smart contracts to identify potential logic issues.

• Manual testing of all core functions, including deposit, withdraw, repay, and borrow, to validate expected behavior and identify edge-case vulnerabilities.

• Local testing to simulate contract interactions and validate functional and security assumptions.

• Local deployment and testing with Foundry.