Sky Diamond PAU v1.13

Summary

The most critical subjects covered in our audit are functional correctness, asset solvency, access control,and external integrations. The general subjects covered are code consistency and documentation.The most notable findings within this report include violations of functional correctness (e.g. Conflicting slippage constraints block UniswapV3Facet.removeLiquidity) and asset solvency (e.g. Dynamic Call Targets Can Bypass Integration Boundaries). These findings have been resolved.

The remaining open findings, the medium-severity Permissionless asset inflows inflate rate limits and some lower-severity ones, have been acknowledged, with the exception of Reentrancy guard is per-Controller while theALMProxy is shared, which was raised in the latest reviewed version.

In summary, we find that the codebase provides a good level of security.

It is important to note that security audits are time-boxed and cannot uncover all vulnerabilities. Theycomplement but don't replace other vital measures to secure a project.

‍

About Sky Diamond PAU v1.13

Sky implements Diamond PAU (Parallelized Allocation Units), a modular, facet based architecture that replaces the legacy ALM Controller. Integrations are deployed as standalone facet contracts and registered in a shared Beacon; each deployment’s Controller syncs the relevant integration configs, routes allocator calls through its selector dispatch table, and relies on dedicated AccessControls andRateLimits contracts for authorization. Funds remain in the deployment’s ALMProxy, and existing legacyALMProxy instances can be reused by authorizing the new Controller as the proxy’s controller.

The latest reviewed iteration, v1.13.0-beta.0, refactors the PAUFactory from an atomic full-system deployer into a set of per-component deployers that produce contracts with the expected bytecode where wiring is now performed by governance after deployment rather than atomically by the factory. The preceding v1.12.0 performed the final adjustments preparing the codebase for release, and the trust model under which upgradeable integrations are treated as potentially malicious was finalized in an earlier release candidate.