RUJI Lending - THORChain / Rujira

1. Introduction

THORChain engaged Halborn to conduct a security assessment of the Ghost Vault smart contract, beginning on October 19th, 2025 and ending on October 23th, 2025. Commit hashes and further details can be found in the Sources section of this report.

Ghost Vault is a CosmWasm-based lending and borrowing protocol designed to operate on top of the Rujira ecosystem. It enables users to deposit native assets into a vault and earn interest, while allowing borrowers to draw liquidity against those deposits. The protocol maintains two internal accounting pools (a deposit pool and a debt pool) and determines interest rates dynamically based on real-time utilization ratios. Interest accrual is applied linearly over time, and all interactions (deposits, borrows, repayments, withdrawals) trigger synchronization of the accumulated interest between pools.

2. Assessment Summary

The team at Halborn assigned a full-time security engineer to evaluate the security of the smart contracts. The security engineer is a blockchain and smart-contract security expert with advanced penetration testing, smart-contract auditing, and deep knowledge of CosmWasm and other Web3 ecosystems.

The purpose of this assessment is to:

• Ensure that core vault functions operate as intended and maintain consistent accounting between depositors and borrowers.

• Identify potential vulnerabilities or logic flaws in the interest calculation, liquidity management, and share issuance mechanisms.

In summary, Halborn identified some improvements to reduce the likelihood and impact of risks, which were mostly addressed by the Rujira team. The primary recommendations were the following:

• Convert overpayment shares back to base tokens before refunding to ensure accurate user reimbursements.

• Enforce borrower limits in base tokens instead of shares to prevent exceeding the real debt cap.

• Apply interest in chunks and update last_updated incrementally to avoid persistent DoS after long idle periods.

• Reject or accumulate tiny deposits that would mint zero shares to prevent silent value donation.

• Add a hard APR cap to prevent extreme rates or unsafe configurations.

• Validate all new interest parameters on sudo SetInterest to reject invalid or unsafe curves.

• Add a guard in repay for an empty debt pool to prevent division-by-zero reverts.

• Introduce a sudo-controlled pause mechanism to allow emergency stopping of critical operations during incidents.

3. Test Approach and Methodology

Halborn performed a combination of manual and automated security testing to balance efficiency, timeliness, practicality, and accuracy in regard to the scope of this assessment. While manual testing is recommended to uncover flaws in logic, process, and implementation; automated testing techniques help enhance coverage of the code and can quickly identify items that do not follow the security best practices. The following phases and associated tools were used during the assessment:

• Research into architecture, purpose, and use of the platform.

• Manual code read and walk through.

• Manual Assessment of use and safety for the critical Rust variables and functions in scope to identify any arithmetic related vulnerability classes.

• Architecture related logical controls.

• Cross contract call controls.

• Scanning of Rust files for vulnerabilities (cargo audit)

• Review and verification of integration tests.