What has been reviewed, and what has not

Overview

OverflowVault, OverflowRouter, OverflowEngine and OverflowReserve (the reviewed v2 core, with its pay token generalised from USDG to kHYPE); the new KHypeAdapter, KHypeRateOracle and KHypeRateSender; the testnet stand-ins TestKHYPE and TestStakingAccountant; the deployment pipeline and the Next.js app.

• Line-by-line manual review of the three new contracts and of every call between them and the core.
• Diff review of the four core contracts against the v2 contracts reviewed on 29 September 2026: the only change is the pay token, renamed from usdg to token and set at deployment.
• 16 Foundry tests covering bridge-only rate updates, one-time sender binding, out-of-order observations, the bootstrap haircut, checkpoint windows, HYPE-denominated principal, yield from rate growth, slashing impairment, stale-rate behaviour, spending, settlement from yield only, debt-locked withdrawals and exits.
• Full deployment rehearsal on local forks of HyperEVM testnet and Elysium testnet, including a simulated bridge delivery from the aliased sender, wiring, Reserve funding and a 100 kHYPE deposit with non-zero spending power.
• Read-only integrity checks in the app for every contract’s bytecode and 13 wiring reads, including the oracle’s bound sender on HyperEVM.

Foundry 1.8.0 (solc 0.8.30) with forge lint static analysis, TypeScript, ESLint. Slither and other standalone analyzers were not run.

forge lint on contracts/overflow: 0 errors, 39 warnings. In the new contracts these are day-scale timestamp windows, tuple reads from the oracle that intentionally ignore one value, and an event emitted after the call to Elysium’s canonical inbox. The remainder are in the unchanged v2 core and were triaged in its review.

• No proxies, no upgrade path and no admin sweep. Routes are immutable once set; the admin can pause deposits and spending, disable routes and set limits, but cannot pause withdrawals or exits or move positions.
• KHypeAdapter only accepts calls from OverflowVault and holds every deposited kHYPE itself; it never lends or swaps it.
• KHypeRateOracle has no function that lets the owner write a rate. The owner can bind the HyperEVM sender exactly once.

Source verification on the Elysium explorer follows the live deployment. Until then, the source is in contracts/overflow/.

• KHypeRateSender reads kHYPEToHYPE(1e18) from the accountant in the same transaction that creates the bridge message, so the caller cannot choose the rate.
• The oracle accepts updates only from the sender’s aliased address, which only Elysium’s canonical bridge can produce for a HyperEVM contract.
• Observations are ordered by HyperEVM timestamp; an older message redeemed late can never overwrite a newer rate. Timestamps more than 1 hour ahead of Elysium and rates outside 0.1–100 HYPE per kHYPE are rejected.
• Anyone can trigger a relay by paying the bridge fee. Excess fee is refunded to them on Elysium.

• Principal is recorded in HYPE at the deposit rate. Yield is the kHYPE held above what covers that principal at the current rate, rounded in the protocol’s favour.
• The observed APR is measured between relayed observations at least 1 and at most 30 days apart, capped at 10%. A longer gap or a falling rate gives 0%.
• The launch rate comes from real rate growth over the previous days, with a 75% haircut, and is rejected if the window is outside 1–7 days or the measured rate is above 50%.
• If kHYPE’s rate falls below a position’s principal (for example after slashing), the position is marked impaired: no new spending, no harvest. Exit still returns all held kHYPE.

• Deposits and withdrawals need a relayed rate no older than 14 days, so a position is never valued on a lapsed rate.
• Exit works with any rate, including none, and returns everything the position holds when there is no debt.
• A withdrawal can never take more than the kHYPE covering principal, so yield stays invested until harvested or exited.

• Spending, the Reserve and repayment all use kHYPE, so there is no price oracle or conversion between them.
• Settlement can only take kHYPE above principal and always leaves the principal side intact (tested).
• Spending power is zero whenever the APR observation or the relayed rate is older than 14 days.

• The deployment script records every address and receipt to config and the app reads them from there; nothing is typed by hand.
• On testnet, Kinetiq is not available on HyperEVM testnet, so TestKHYPE and TestStakingAccountant stand in. They are excluded from the mainnet path.
• The testnet deployer key is separate from the mainnet key and is stored outside the repository.

Known External Risks

Overflow depends on networks and protocols it does not control. None of these can be fixed inside Overflow.