.svg)
About Permissionless SLL Withdrawals
SparkDAO implements Permissionless SLL Withdrawals, a permissionless backup withdrawal path for Spark savings vaults that sources liquidity from a whitelisted set of venues to complete a redemption when the vault is illiquid and the off-chain ALM Planner is unavailable.
Audit Summary
The most critical subjects covered in our audit are functional correctness, access control, and the precision of the withdrawal accounting. Special attention was paid to the containment of the permissionless entry point: the contract acts as an allocator on the controller, the amounts it draws from the ALMProxy are not checked against the obligations towards the Spark vaults, and the per (asset, vault) transfer rate limits are the only technical bound on this path. The security of the system therefore additionally depends on a conservative governance configuration, see Configuration Considerations. Security regarding the aforementioned subjects is high, provided the system is correctly configured and operated. The general subjects covered are documentation, specification, error handling, and testing. In summary, we find that the codebase provides a high level of security if correctly configured and operated.
It is important to note that security audits are time-boxed and cannot uncover all vulnerabilities. They complement but don't replace other vital measures to secure a project.