Quantstamp reviewed Solv Protocol (Solv Protocol - BTC Redemption) on 15 Dec 2025: 5 findings, 0 critical; 2 marked fixed, 3 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 3 | 0 | 2 |
The `withdrawFeeRate` is an admin-controlled parameter that can be updated at any time and is applied immediately when users call the `withdrawBTCPlus()` function. Since users typically estimate their expected net `solvBTC` output off-chain before submitting a transaction, a fee update occurring shortly before execution may result in users receiving less value than anticipated. This creates a front-running-style risk where a legitimate admin fee update, applied between a user’s transaction submission and execution, may lead to reduced `solvBTC` output. Although the admin is assumed to operate in good faith, users who are unaware of recent parameter changes or rely on stale off-chain data have no on-chain protection against this behavior due to the absence of a minimum output check.
This contract acts as a rate limited redeem mechanism, imposing both total limits per time period and limits for single withdrawal actions. However, a single user could submit multiple calls to `withdrawBTCPlus()` within a single transaction to exhaust the entire total limit, which can be retrieved from `remainingWithdrawAmount()`.
The `withdrawBTCPlus()` function relies on `getValueByShares()`, which depends on the external NAV of `BTC+`. Since the NAV can legitimately increase or decrease over time, a deviation between transaction submission and execution may result in users receiving less solvBTC than expected, even without any malicious behavior.
The report names a repository or files. Open the report to see its scope.
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us