Synthetix BFP Market
Security-review case study
“Having seen many audits over many years, no one even comes close to Protocol Defence's approach, and the quality of their audit is unmatched.”
KalebCore contributor, Synthetix
Overview
This page shows Protocol Defence’s thorough security-review process, highlighting our recent engagement with Synthetix and their BFP Market. You can view the full review report here.
Protocol Defence
Protocol Defence is a leader in Smart Contract security, redefining the review model by leveraging dual independent review teams, advanced fuzz testing, and an innovative Pay-Per-Vulnerability pricing model. This unique approach maximizes the identification of vulnerabilities, ensuring clients receive the most effective security reviews - for when it needs to be right the first time.
Synthetix
Synthetix is a leading DeFi protocol, enabling the creation and trading of synthetic assets on Ethereum. Their BFP Market allows stablecoin issuers and DeFi protocols to create delta-neutral perpetuals, leveraging ETH as collateral.
Why teams pick Protocol Defence
With extensive experience securing perpetuals and derivatives markets, Protocol Defence brings deep domain expertise and a proven track record. Our dual-team review model, combined with rigorous stateful fuzzing, ensures comprehensive coverage and a high standard of security. This approach makes Protocol Defence the ideal partner for safeguarding complex codebases like Synthetix’s BFP Market.
We chose to work with Protocol Defence Audits because of the, "Quality of audit findings [available in their] reports."
KalebCore contributor, Synthetix
The Report
The Audit Process - Scope & Methodology
#
Protocol Defence’s review process was comprehensive and methodical. Two independent security teams conducted parallel reviews to maximize vulnerability coverage, ensuring no potential exploit went unnoticed. Alongside manual code reviews—meticulously combing through the codebase to identify logical errors and complex edge cases—Protocol Defence employed extensive fuzz testing using Echidna.
This involved over 140 million runs targeting critical protocol invariants, helping to uncover hidden vulnerabilities and stress-test the system under extreme scenarios. Throughout the process, invariant assessments ensured that key protocol behaviors remained consistent and secure, safeguarding the BFP Market against a wide range of attack vectors.
Fuzz Testing Results
Protocol Defence’s fuzz testing assessed 22 critical invariants with over 140 million runs, covering scenarios such as margin withdrawals, collateral modifications, liquidations, and order settlements.
Audit Findings & Remidiations
Protocol Defence identified and categorized a wide range of vulnerabilities throughout the Synthetix BFP Market audit, spanning multiple severity levels. In total, 9 critical issues were discovered, all of which were fully resolved. The audit also found 5 high-severity vulnerabilities, with 4 resolved and 1 acknowledged by the Synthetix team. Additionally, 21 medium-severity issues were found, with 18 resolved and 3 either acknowledged or partially resolved.
Lastly, 24 low-severity findings were reported, of which 19 were resolved while 5 were acknowledged or partially addressed.
Among the most critical issues identified were:
User Debt Overwritten When Cancelling Orders: This vulnerability was addressed by implementing a dedicated debt-handling logic, ensuring accurate debt accounting during order cancellations.
Splitting Positions Below Initial Margin: Protocol Defence discovered that account splits could allow positions to fall below the required initial margin. This was resolved by enforcing stricter margin validation rules post-split.
Withdrawals Without Paying Debt: A significant flaw allowed users to withdraw collateral without settling outstanding debt. The issue was patched, ensuring all debt is cleared before collateral withdrawals are permitted.
Each finding was meticulously documented and accompanied by detailed Proof-of-Concepts (PoCs), enabling the Synthetix team to implement swift and effective remediations. This collaborative process ensured that vulnerabilities were not only identified but thoroughly addressed, significantly enhancing the security and resilience of the BFP Market.
Results & Impact
Throughout the four-week engagement, Protocol Defence found a total of 59 vulnerabilities, with 9 Critical and 5 High-severity issues identified.
Protocol Defence’s emphasis on comprehensive testing went beyond manual code reviews. Leveraging a tailored Echidna fuzzing suite, the team executed over 140 million fuzzing runs, rigorously stress-testing 22 core protocol invariants. These tests ensured that the BFP Market upheld its intended behavior, even under extreme and unforeseen conditions.
But the impact of the review extended beyond just vulnerability discovery. Protocol Defence’s collaboration with the Synthetix team led to significant improvements in code quality, test coverage, and resilience against edge-case scenarios. By the end of the engagement, Synthetix was equipped with a fully functional fuzzing harness, enabling them to continuously verify protocol invariants in future updates.
In total, more than 59 issues were identified, addressed, and remediated, leaving the BFP Market significantly more secure. Beyond the immediate fixes, the engagement empowered Synthetix with tools and knowledge to maintain long-term protocol integrity.
Key Metrics
Total Findings: 14 Critical/High Issues Resolved
- Fuzzing Runs: 140 Million+
- Audit Duration: 4 Weeks
Platform: Ethereum Mainnet