CALC - Manager/Scheduler/Strategy - THORChain

1. Introduction

This report was commissioned by THORChain, a leading decentralized liquidity network, to assess the security and robustness of the CALC Manager, Scheduler, and Strategy smart contracts. The assessment was performed by Halborn’s experienced security team, focusing on the code released at commit 632c63b. The review covered all functionality in manager.wasm, scheduler.wasm, and strategy.wasm between the 11th August 11, 2025, and 20th August 20, 2025. The primary objective of this engagement’s core purpose was to identify vulnerabilities, ensure protocol reliabilityand strengthen overall security.

2. Assessment Summary

Halborn’s team of seasoned specialists performed a comprehensive security assessment over a 8-day period. The key goals included discovering critical vulnerabilities, evaluating strategic robustness, and improving protocol defenses.

The overall security posture showed ambitious protocols with substantial complexity; several impactful issues were identified. Noteworthy fixes include resolution of a severe rebate-stealing vulnerability in the Scheduler contract, along with remediation of other high- and medium-priority issues—such as input validation weaknesses, logic errors in price comparison, and insufficient robustness against market manipulation. Operational and configurability enhancements were also successfully implemented.

All findings have been addressed and remediated by the Calc team.

3. Test Approach and Methodology

A hybrid methodology was used, balancing deep manual review with targeted automated analysis. The work began with codebase familiarization, design verification, and threat modeling. Manual inspection dissected business logic, access control, storage management, and validator relationships. Automated static analysis scanned for low-level errors and overlooked vulnerabilities. Simulated execution and scenario testing further stressed edge cases and protocol invariants. The rigorous sequencing of methods ensures that coverage was exhaustive, with no reliance on checklist-based auditing. Continuous collaboration with the development team enabled rapid triage and remediation of critical findings.