CALC - Manager/Scheduler/Strategy Audit | THORChain / Rujira

Summary

100% of all REPORTED Findings have been addressed

About this report

Assessment Type

Assurance Assessment

Date of Engagement

August 11th, 2025 - August 20th, 2025

Source Code

calc-rs calc-rs calc-rs

Assessed Commit ID

939d055 632c63b 39df0d2

Severity Breakdown

0Acknowledged
0Risk Accepted
10Solved
10All Findings

Critical1
- 1Solved
High0
Medium1
- 1Solved
Low4
- 4Solved
Informational4
- 4Solved

Introduction#

This report was commissioned by THORChain, a leading decentralized liquidity network, to assess the security and robustness of the CALC Manager, Scheduler, and Strategy smart contracts. The assessment was performed by Halborn’s experienced security team, focusing on the code released at commit 632c63b. The review covered all functionality in manager.wasm, scheduler.wasm, and strategy.wasm between the 11th August 11, 2025, and 20th August 20, 2025. The primary objective of this engagement’s core purpose was to identify vulnerabilities, ensure protocol reliabilityand strengthen overall security.

Assessment Summary#

Halborn’s team of seasoned specialists performed a comprehensive security assessment over a 8-day period. The key goals included discovering critical vulnerabilities, evaluating strategic robustness, and improving protocol defenses.

The overall security posture showed ambitious protocols with substantial complexity; several impactful issues were identified. Noteworthy fixes include resolution of a severe rebate-stealing vulnerability in the Scheduler contract, along with remediation of other high- and medium-priority issues—such as input validation weaknesses, logic errors in price comparison, and insufficient robustness against market manipulation. Operational and configurability enhancements were also successfully implemented.

All findings have been addressed and remediated by the Calc team.

Test Approach and Methodology#

A hybrid methodology was used, balancing deep manual review with targeted automated analysis. The work began with codebase familiarization, design verification, and threat modeling. Manual inspection dissected business logic, access control, storage management, and validator relationships. Automated static analysis scanned for low-level errors and overlooked vulnerabilities. Simulated execution and scenario testing further stressed edge cases and protocol invariants. The rigorous sequencing of methods ensures that coverage was exhaustive, with no reliance on checklist-based auditing. Continuous collaboration with the development team enabled rapid triage and remediation of critical findings.

Risk Methodology#

Every vulnerability and issue observed by Halborn is ranked based on two sets of Metrics and a Severity Coefficient. This system is inspired by the industry standard Common Vulnerability Scoring System.

The two Metric sets are: Exploitability and Impact. Exploitability captures the ease and technical means by which vulnerabilities can be exploited and Impact describes the consequences of a successful exploit.

The Severity Coefficients is designed to further refine the accuracy of the ranking with two factors: Reversibility and Scope. These capture the impact of the vulnerability on the environment as well as the number of users and smart contracts affected.

The final score is a value between 0-10 rounded up to 1 decimal place and 10 corresponding to the highest security risk. This provides an objective and accurate rating of the severity of security vulnerabilities in smart contracts.

The system is designed to assist in identifying and prioritizing vulnerabilities based on their level of risk to address the most critical issues in a timely manner.

4.1 EXPLOITABILITY

Attack Origin (AO):

Captures whether the attack requires compromising a specific account.

Attack Cost (AC):

Captures the cost of exploiting the vulnerability incurred by the attacker relative to sending a single transaction on the relevant blockchain. Includes but is not limited to financial and computational cost.

Attack Complexity (AX):

Describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Includes but is not limited to macro situation, available third-party liquidity and regulatory challenges.

Metrics:

EXPLOITABILITY METRIC ( $m_e$ )	METRIC VALUE	NUMERICAL VALUE
Attack Origin (AO)	Arbitrary (AO:A)	1
Attack Origin (AO)	Specific (AO:S)	0.2
Attack Cost (AC)	Low (AC:L)	1
	Medium (AC:M)	0.67
	High (AC:H)	0.33
Attack Complexity (AX)	Low (AX:L)	1
	Medium (AX:M)	0.67
	High (AX:H)	0.33

Exploitability

E

is calculated using the following formula:

$E = \prod m_e$

4.2 IMPACT

Confidentiality (C):

Measures the impact to the confidentiality of the information resources managed by the contract due to a successfully exploited vulnerability. Confidentiality refers to limiting access to authorized users only.

Integrity (I):

Measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of data stored and/or processed on-chain. Integrity impact directly affecting Deposit or Yield records is excluded.

Availability (A):

Measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. This metric refers to smart contract features and functionality, not state. Availability impact directly affecting Deposit or Yield is excluded.

Deposit (D):

Measures the impact to the deposits made to the contract by either users or owners.

Yield (Y):

Measures the impact to the yield generated by the contract for either users or owners.

Metrics:

IMPACT METRIC ( $m_I$ )	METRIC VALUE	NUMERICAL VALUE
Confidentiality (C)	None (C:N)	0
	Low (C:L)	0.25
	Medium (C:M)	0.5
	High (C:H)	0.75
	Critical (C:C)	1
Integrity (I)	None (I:N)	0
	Low (I:L)	0.25
	Medium (I:M)	0.5
	High (I:H)	0.75
	Critical (I:C)	1
Availability (A)	None (A:N)	0
	Low (A:L)	0.25
	Medium (A:M)	0.5
	High (A:H)	0.75
	Critical (A:C)	1
Deposit (D)	None (D:N)	0
	Low (D:L)	0.25
	Medium (D:M)	0.5
	High (D:H)	0.75
	Critical (D:C)	1
Yield (Y)	None (Y:N)	0
	Low (Y:L)	0.25
	Medium (Y:M)	0.5
	High (Y:H)	0.75
	Critical (Y:C)	1

Impact

I

is calculated using the following formula:

$I = max(m_I) + \frac{\sum{m_I} - max(m_I)}{4}$

4.3 SEVERITY COEFFICIENT

Reversibility (R):

Describes the share of the exploited vulnerability effects that can be reversed. For upgradeable contracts, assume the contract private key is available.

Scope (S):

Captures whether a vulnerability in one vulnerable contract impacts resources in other contracts.

Metrics:

SEVERITY COEFFICIENT ( $C$ )	COEFFICIENT VALUE	NUMERICAL VALUE
Reversibility ( $r$ )	None (R:N)	1
	Partial (R:P)	0.5
	Full (R:F)	0.25
Scope ( $s$ )	Changed (S:C)	1.25
Scope ( $s$ )	Unchanged (S:U)	1

Severity Coefficient

C

is obtained by the following product:

$C = rs$

The Vulnerability Severity Score

S

is obtained by:

$S = min(10, EIC * 10)$

The score is rounded up to 1 decimal places.

Critical	High	Medium	Low	Informational
9 - 10	7 - 8.9	4.5 - 6.9	2 - 4.4	0 - 1.9

Scope#

(a) Repository:calc-rs

(b) Assessed Commit ID:939d0558b50b805212ff97c014860e8c4639dde7

(a) Repository:calc-rs

(b) Assessed Commit ID:632c63be012f4d57e00e92c69496661b221d9f2b

30 files

contracts

9 files

manager / src

3 files

contract.rs

rust

lib.rs

rust

state.rs

rust

scheduler / src

3 files

contract.rs

rust

lib.rs

rust

state.rs

rust

strategy / src

3 files

contract.rs

rust

lib.rs

rust

(a) Repository:calc-rs

(b) Assessed Commit ID:39df0d2f2c57c2a39bd5b180d54ad53f143ec1e4

Additional scope:packages/calc-rs/src/conditions/asset_value_ratio.rs

e2d69c6e4f007a3189b4f97be9e1103d961ccceb 4f67728fc4146c6f4e4b50c394379d6c373519ff e97cbeced9c06057f1d9de64e7a6315bd9a007bf https://github.com/calculated-finance/calc-rs/pull/15 33125ecbc99503ca4650478fd921b15d755ff5fa 65d19c099bc21b7a4c258482aeaa96605143c39d 637003258adbd27b3d6bf1efbe7b6565a9e0dcfc e408660c76dddaabf83960b4e29539834e28983a 3e3519d52f6fce68ef09e1ad56187cb1891f364f

Out-of-Scope: New features/implementations after the remediation commit IDs.

Assessment Summary & Findings Overview#

#	Title	Severity	Score	Status
HAL-01	Public trigger enumeration enables rebate theft via overwrite	Critical	10.0	Solved08/13/2025
HAL-02	Duplicate denoms are double-counted leading to over-allocation	Medium	5.0	Solved08/18/2025
HAL-03	RUNE incorrectly treated as non-secured in Distribution deposits	Low	2.5	Solved08/18/2025
HAL-04	LinearScalar compares inverse price metrics	Low	2.5	Solved08/18/2025
HAL-05	LinearScalar ignores available balance (Thor)	Low	2.5	Solved08/18/2025
HAL-06	Top-of-book reliance enables cheap price spoofing to influence strategy decisions	Low	2.1	Solved08/21/2025
HAL-07	Missing guards in FIN pricing paths	Informational	1.7	Solved08/20/2025
HAL-08	Withdraw policy on partial fills may cause unnecessary churn or exposure gaps	Informational	0.0	Solved08/20/2025
HAL-09	Over-fetching FIN Book levels (limit=10) while using only top-of-book	Informational	0.0	Solved08/21/2025
HAL-10	Strategy Balances query reports only limit-order positions, omitting other contract funds	Informational	0.0	Solved08/23/2025

Findings & Tech Details#

3e3519d52f6fce68ef09e1ad56187cb1891f364f

Disclaimer#

Halborn strongly recommends conducting a follow-up assessment of the project either within six months or immediately following any material changes to the codebase, whichever comes first. This approach is crucial for maintaining the project’s integrity and addressing potential vulnerabilities introduced by code modifications.