Spark Prime Vault

About Spark Prime Vault

Spark implements Spark Prime Vault, a vault in which users earn yield on USDC by funding Spark’s lending to borrowers. Deposits and redemptions are queued and processed by Spark, while funds that are not yet deployed are held in Spark Vault V2 (spUSDC).

Audit Summary

As a globally trusted security partner for top-tier DeFi protocols, ChainSecurity provides specialized, independent technical analysis of complex smart contract systems, including Spark Vault V2, on which Spark Prime Vault builds.

We greatly appreciate the opportunity to collaborate with Spark, a leading protocol in the Sky ecosystem, on this project.

We have conducted a thorough review of the scope. The most important areas covered in our review are:

• The request queues, since deposits, cancellations and redemptions are processed in order, with partial fills and an instant fill, which makes their accounting and liveness critical. We found that queued requests can be reduced to dust, see Dust Can Enter the Queues.
• The precision of arithmetic operations, since every request is converted between USDC, spUSDC shares and spPrime at two independently growing exchange rates. We found that redemption payouts round against the vault, see Redemptions Round Against the Vault.
• The integration with Spark Vault V2 and USDC, since the vault relies on spUSDC for its liquidity and on the USDC blacklist to handle failed payouts. We describe the resulting dependencies in Deposits Depend on the spUSDC Deposit Cap and Funds of Unprocessed Requests Are Not Reserved.

We provide this audit report to assist in forming an opinion on the risk profile of Spark Prime Vault. In summary, we find that the codebase provides a good level of security, if operated under the assumptions documented in System Overview, Trust Model and System Considerations.

It is important to note that security audits are time-boxed and cannot uncover all vulnerabilities. They complement but don’t replace other vital measures to secure a project.