Stellar AMM Audit | Normal Finance | Halborn Audit Reports

Summary

100% of all REPORTED Findings have been addressed

About this report

Assessment Type

Assurance Assessment

Date of Engagement

June 25th, 2025 - August 5th, 2025

Source Code

normal-stellar-amm

Assessed Commit ID

5e746ed

Severity Breakdown

0Acknowledged
0Risk Accepted
12Solved
12All Findings

Critical0
High3
- 3Solved
Medium1
- 1Solved
Low2
- 2Solved
Informational6
- 6Solved

Introduction#

Halborn was engaged by the Normal AMM team to perform a targeted security assessment of their Soroban-based automated market maker (AMM) protocol on Stellar. The scope included analyzing the core on-chain components responsible for liquidity management, routing, oracle integration, incentives, and access control. The assessment aimed to verify correctness, safety, and economic robustness.

Assessment Summary#

A senior blockchain security engineer from Halborn conducted the review full-time. The engineer has extensive experience in Rust, Soroban/Stellar, AMM design, and protocol security, including upgradeability, authorization, and oracle systems.

The codebase components reviewed included:

Contracts: pool, pool_router, oracle_registry, pool_plane, pool_swap_fee, insurance_fund, liquidity_calculator, token
Shared modules: access_control, incentives, utils, upgrade

The review focused on verifying economic invariants (such as pricing, fees, and shares), oracle validation and safeguards, privilege boundaries, emergency controls, and upgrade procedures.

Engagement objectives included:

Ensuring that new and modified functions behave as intended and are resistant to misuse and edge cases.
Identifying vulnerabilities that could lead to fund loss, invariant violations, incorrect state transitions, oracle manipulation, privilege escalation, or denial of service.
Highlighting areas where stronger invariants, defensive checks, or clearer authorization controls can reduce operational and economic risks.

Test Approach and Methodology#

To ensure comprehensive and cross-cutting coverage, the assessment employed a consistent methodology across all first-party contracts and shared modules within the workspace:

Contracts: buffer, insurance_fund, liquidity_calculator, oracle_registry, pool, pool_plane, pool_router, pool_swap_fee, token
Shared modules: access_control, incentives, pool_tokens, upgrade, utils
Integration tests located in: contracts/integration_tests

The approach combined architecture mapping, manual expert review, static and dynamic analysis, property-based testing, and adversarial scenario simulations:

1) Repository-wide inventory and architecture mapping

Mapped all public entry points declared in interface.rs and within #[contractimpl] blocks; analyzed data and control flows among pool, pool_router, oracle_registry, pool_plane, liquidity_calculator, insurance_fund, and token contracts.
Identified trust boundaries, administrative roles, kill switches, upgrade paths, and oracle dependencies; documented invariants for each component.

2) Manual line-by-line review (across all crates)

Examined each contract’s contract.rs, storage.rs, errors.rs, and events.rs files:
Verified authorization and role checks via modules/access_control.
Assessed storage keys, data lifetimes, bumping strategies, and differentiated between persistent and temporary data usage.
Analyzed mathematical invariants within pool.rs, liquidity_calculator, pool_swap_fee, utils::math, and incentives mechanisms.
Reviewed cross-contract calls (router, oracle, plane, token) for error propagation, potential DoS vulnerabilities, and reentrancy issues.
Verified upgrade flows via modules/upgrade across upgradable contracts.
Assessed emergency/kill toggles, expiry, and settlement transition mechanisms.
Ensured event schemas are consistent and correctly implemented.

3) Static analysis and linting (workspace-wide)

Applied linting tools and targeted grep scans to identify anti-patterns, including:
Unchecked type conversions, saturation underflows, panics affecting user flows.
Misuse of U256 and fixed-point math, including rounding errors.
Incomplete authorization checks and role management inconsistencies.

4) Property-based testing and fuzzing for critical math routines

Focused on:

Swap route correctness, fee adjustments, and invariant violations (such as fee residues).
Precision in receive computations and boundary condition handling.
Price functions (peg_price, get_delta_a) and rolling metrics.
Incentives accumulation and distribution, including per-user and per-pool calculations, with correct handling of pagination constants.
Tested edge cases involving zero or near-zero values, maximum fees, large reserves, and rounding boundaries.

5) Stateful adversarial testing and PoC development

Designed multi-step scenarios across contracts to detect emergent behaviors:
Upgrade commit, apply, and revert; emergency mode activation and deactivation within deadlines.
Kill/un-kill toggles; roles for pausing versus emergency pauses.
Handling of oracle data volatility and staleness, cached versus fresh data paths, with safeguards.
Insurance fund claims constrained by tiers and thresholds.
Router orchestration and liquidity calculator during failures.
Prototype calculations for NAV/share underpricing during rebalancing, supported by mathematical proof independent from harness dependencies.

6) Integration testing and cross-contract orchestration

Utilized existing integration tests and created custom scenarios:
Deployment of contracts using contractimport! for pool_plane, liquidity_calculator, pool_router, and oracle_registry.
End-to-end testing covering initialization, deposits, swaps, withdrawals, incentives, claims, rebalancing, upgrades, and emergency procedures.
Used functions like utils::test_utils::jump to manipulate time for testing staleness, delays, and expiry conditions.

7) Permission boundary testing (positive and negative cases)

Systematically verified role-based permissions for Admin, EmergencyAdmin, RewardsAdmin, OperationsAdmin, PauseAdmin, and EmergencyPauseAdmin. Patterns followed those in each crate’s test_permissions.rs.
Reviewed ownership transfer workflows and deadline enforcement for correctness.

8) Oracle validation and economic safety assessment

Validated oracle safeguards, including volatility thresholds, staleness limits, clamping, TWAP updates, and cached versus live data handling.
Assessed core economic invariants such as:
Enforcement of AMM invariant, accurate fee accounting, and residue handling.
Share valuation consistency aligned with pool NAV during rebalancing.
Limits on insurance coverage per tier, as well as revenue withdrawals and settlement procedures.

9) Token interactions and assumptions testing

Verified token helper functions (utils::token), pool token management (pool_tokens), and behaviors regarding allowances and transfers.
Analyzed dependencies on standard token implementations and error handling pathways for non-standard tokens in strict-receive and refund scenarios.

10) Performance, resource consumption, and reliability evaluations

Considered ledger instruction limits, storage growth, and pagination (e.g., PAGE_SIZE).
Examined pool_plane updates for potential liveness issues and recommended implementing soft-fail patterns where appropriate to improve reliability.

11) Test execution and validation strategy

Developed targeted tests and proofs of concept to validate identified risks and invariants, including snapshot captures of critical error pathways.

This methodology achieved full coverage of the codebase with focused depth on high-risk areas such as oracle integration, upgradeability, access control, AMM mathematics, and incentives, enabling the detection of both correctness and economic vulnerabilities.

Risk Methodology#

Every vulnerability and issue observed by Halborn is ranked based on two sets of Metrics and a Severity Coefficient. This system is inspired by the industry standard Common Vulnerability Scoring System.

The two Metric sets are: Exploitability and Impact. Exploitability captures the ease and technical means by which vulnerabilities can be exploited and Impact describes the consequences of a successful exploit.

The Severity Coefficients is designed to further refine the accuracy of the ranking with two factors: Reversibility and Scope. These capture the impact of the vulnerability on the environment as well as the number of users and smart contracts affected.

The final score is a value between 0-10 rounded up to 1 decimal place and 10 corresponding to the highest security risk. This provides an objective and accurate rating of the severity of security vulnerabilities in smart contracts.

The system is designed to assist in identifying and prioritizing vulnerabilities based on their level of risk to address the most critical issues in a timely manner.

4.1 EXPLOITABILITY

Attack Origin (AO):

Captures whether the attack requires compromising a specific account.

Attack Cost (AC):

Captures the cost of exploiting the vulnerability incurred by the attacker relative to sending a single transaction on the relevant blockchain. Includes but is not limited to financial and computational cost.

Attack Complexity (AX):

Describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Includes but is not limited to macro situation, available third-party liquidity and regulatory challenges.

Metrics:

EXPLOITABILITY METRIC ( $m_e$ )	METRIC VALUE	NUMERICAL VALUE
Attack Origin (AO)	Arbitrary (AO:A)	1
Attack Origin (AO)	Specific (AO:S)	0.2
Attack Cost (AC)	Low (AC:L)	1
	Medium (AC:M)	0.67
	High (AC:H)	0.33
Attack Complexity (AX)	Low (AX:L)	1
	Medium (AX:M)	0.67
	High (AX:H)	0.33

Exploitability

E

is calculated using the following formula:

$E = \prod m_e$

4.2 IMPACT

Confidentiality (C):

Measures the impact to the confidentiality of the information resources managed by the contract due to a successfully exploited vulnerability. Confidentiality refers to limiting access to authorized users only.

Integrity (I):

Measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of data stored and/or processed on-chain. Integrity impact directly affecting Deposit or Yield records is excluded.

Availability (A):

Measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. This metric refers to smart contract features and functionality, not state. Availability impact directly affecting Deposit or Yield is excluded.

Deposit (D):

Measures the impact to the deposits made to the contract by either users or owners.

Yield (Y):

Measures the impact to the yield generated by the contract for either users or owners.

Metrics:

IMPACT METRIC ( $m_I$ )	METRIC VALUE	NUMERICAL VALUE
Confidentiality (C)	None (C:N)	0
	Low (C:L)	0.25
	Medium (C:M)	0.5
	High (C:H)	0.75
	Critical (C:C)	1
Integrity (I)	None (I:N)	0
	Low (I:L)	0.25
	Medium (I:M)	0.5
	High (I:H)	0.75
	Critical (I:C)	1
Availability (A)	None (A:N)	0
	Low (A:L)	0.25
	Medium (A:M)	0.5
	High (A:H)	0.75
	Critical (A:C)	1
Deposit (D)	None (D:N)	0
	Low (D:L)	0.25
	Medium (D:M)	0.5
	High (D:H)	0.75
	Critical (D:C)	1
Yield (Y)	None (Y:N)	0
	Low (Y:L)	0.25
	Medium (Y:M)	0.5
	High (Y:H)	0.75
	Critical (Y:C)	1

Impact

I

is calculated using the following formula:

$I = max(m_I) + \frac{\sum{m_I} - max(m_I)}{4}$

4.3 SEVERITY COEFFICIENT

Reversibility (R):

Describes the share of the exploited vulnerability effects that can be reversed. For upgradeable contracts, assume the contract private key is available.

Scope (S):

Captures whether a vulnerability in one vulnerable contract impacts resources in other contracts.

Metrics:

SEVERITY COEFFICIENT ( $C$ )	COEFFICIENT VALUE	NUMERICAL VALUE
Reversibility ( $r$ )	None (R:N)	1
	Partial (R:P)	0.5
	Full (R:F)	0.25
Scope ( $s$ )	Changed (S:C)	1.25
Scope ( $s$ )	Unchanged (S:U)	1

Severity Coefficient

C

is obtained by the following product:

$C = rs$

The Vulnerability Severity Score

S

is obtained by:

$S = min(10, EIC * 10)$

The score is rounded up to 1 decimal places.

Critical	High	Medium	Low	Informational
9 - 10	7 - 8.9	4.5 - 6.9	2 - 4.4	0 - 1.9

Scope#

(a) Repository:normal-stellar-amm

(b) Assessed Commit ID:5e746edff7a238b1196a9b287e904dfe6089f346

11 files

● . / modules

4 files

incentives

1 file

\\*

pool_tokens

1 file

\\*

upgrade

1 file

\\*

utils

1 file

\\*

access_control

insurance_fund

oracle_registry

1c7606037849340f3bdebfa0d47978ece2b6fd54bf069b9febf511f031fd7821963c5db6a19f1159ad15b98367f6a99429480b9da65ffe661d65b8f3281bb6a8c23370412842b5ee82f36e1d5f72d90fc9e27d659ec7d071fb5f39c639a225aa42ebfa4d6443f8b3af88d0d7ec66e6dfdfd0e48d32956d33d8a27555b4c2f1f724a33ff71de1f908fa85283d9b274e9056a4ee682e0b97c26e662626ef14ce5d3361556aac47f7919c64515cf1d049b6477d32ecdc12345f8f6f09613ea67c3eab75413304f5966c211a138d2a75118027fd61d60e8bb437770f9107

Out-of-Scope: New features/implementations after the remediation commit IDs.

Assessment Summary & Findings Overview#

#	Title	Severity	Score	Status
HAL-01	Oracle Registry Argument Swap Triggers Panic on Price Up-Ticks	High	7.5	Solved08/01/2025
HAL-02	Sanitize New Price Underflows On Price Drop, Triggering Protocol Wide Panic	High	7.5	Solved08/01/2025
HAL-03	NAV Underpricing via Fixed Share Minting	High	7.5	Solved08/04/2025
HAL-04	PoolRouter Reward Front-Run Enables Zero-Emission Griefing	Medium	5.0	Solved08/01/2025
HAL-05	Dust-Initialisation / Fee-Skimming Risk — totalLP Can Fall to 0	Low	2.5	Solved07/29/2025
HAL-06	Stale-delay Allows Frozen or Cached Prices to Look Fresh	Low	2.5	Solved08/01/2025
HAL-07	Zero-Amount Deposits Allowed	Informational	1.7	Solved07/30/2025
HAL-08	Zero-Amount Stake Accepted	Informational	1.7	Solved07/30/2025
HAL-09	Price-override Cooldown can be Bypassed	Informational	1.1	Solved08/01/2025
HAL-10	Redundant Ownership-Transfer: Future Owner Can Equal Current Owner	Informational	0.5	Solved08/01/2025
HAL-11	sanitize_clamp_denominator is Unchecked (Division-by-Zero Risk)	Informational	0.4	Solved07/31/2025
HAL-12	Unbounded Synthetic-Minting During “Reduce-Only” Mode	Informational	0.0	Solved08/01/2025

Findings & Tech Details#

HAL-01Solved

Oracle Registry Argument Swap Triggers Panic on Price Up-Ticks

High

7.5AO:A/AC:L/AX:L/R:N/S:U/C:N/A:H/I:N/D:N/Y:NAO:A/AC:L/AX:L/R:N/S:U/C:N/A:H/I:N/D:N/Y:N

Description

Proof of Concept

Recommendation

Remediation Comment

Addressed in:

Uniswap V2 Whitepaper, section 3.4 “Minimum Liquidity”
Uniswap V2 Core implementation — MINIMUM_LIQUIDITY = 1000 burned to address(0)

Remediation Comment

Addressed in:

211a138d2a75118027fd61d60e8bb437770f9107

Disclaimer#

Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.