Security self-assessment
Automated analysis, manual code review and on-chain configuration checks of Kyte's deployed contracts on Robinhood Chain (4663). Version 1.1, 9 November 2026, snapshot block 109,974,684.
Summary
Twelve deployed contracts, about 1,750 lines of Kyte code excluding comments.
The core option escrow is sound. Collateral can only go to its seller or to the option holder. Exits keep working while the protocol is paused. Every entry point is protected against reentrancy, and fees are capped in code.
The five low findings cover the on-chain buyback route, which is not in use (buybacks are currently executed manually), a griefing case on the ETH convenience Router that has a direct-WETH fallback, a timelock delay that differs from the code comments, and the dependency of physical settlement on token transferability. None of them allows anyone to take escrowed collateral or staked $KYTE.
Findings (10)
Each row opens the finding in the full report, with its impact, recommendation and the team's response.
| ID | Severity | Title | Status |
|---|---|---|---|
| KYT-01 | Low | The on-chain buyback route points to an unfunded pool (route not in use) | Acknowledged |
| KYT-02 | Low | The on-chain buyback price floor follows the last fill (route not in use) | Acknowledged |
| KYT-03 | Low | The Router can be blocked by sending it 1 wei of WETH (direct market access unaffected) | Acknowledged |
| KYT-04 | Low | The timelock delay is 10 minutes on chain; the code comments describe 48 hours | Acknowledged |
| KYT-05 | Low | Physical settlement depends on the underlying token staying transferable | Acknowledged |
| KYT-06 | Info | The guardian Safe needs a single signature | Acknowledged |
| KYT-07 | Info | StakingPool.notifyReward emits no event | Acknowledged |
| KYT-08 | Info | KyteHaltGate reverts instead of answering if the oracle reports a future timestamp | Acknowledged |
| KYT-09 | Info | Rebasing tokens would break collateral accounting | Acknowledged |
| KYT-10 | Info | Live contracts were built from different commits | Acknowledged |
Checks that passed
Properties confirmed by reading the code and the live configuration.
- ✓No admin path to escrowed collateralCollateral only ever moves to its seller, or to the option holder on exercise.
- ✓Exits are never pausedCancel, exercise, expire, unstake, claim and split all work while paused. Pause only blocks new exposure.
- ✓Reentrancy guardedEvery state-changing entry point uses nonReentrant (transient storage). State is final before any transfer.
- ✓Fees capped in codePremium fee ≤ 10% and exercise fee ≤ 1%, fixed per position. Live: 3% / 0.1%.
- ✓Fee-on-transfer tokens rejectedCollateral pulls and stakes check that the balance grew by exactly the amount transferred.
- ✓NFT minting locked to the marketsOnly the market that owns an ID tag can mint or burn it. Markets are set once and wired correctly on chain.
- ✓Fee split boundedShares must sum to 100% and stakers always get at least 20%.
- ✓No just-in-time staking rewardsNew stake waits one epoch and is then locked for a full epoch.
- ✓Router holds nothingRefunds go only to the caller. The Router held 0 WETH and 0 ETH at the snapshot block.
- ✓Deployer has no lingering powerThe deployer holds no timelock role, and OptionNFT market wiring is locked.
- ✓Deployed code matches the sourceEvery contract in scope is a full Sourcify match (creation and runtime bytecode).
Scope
The live contracts at block 109,974,684. Each address is a full Sourcify match, so the code analysed is the code that runs. Out of scope: the $KYTE token contract, its trading pool, the Uniswap v4 PoolManager, Harmonic's oracle and off-chain systems.
| Contract | Address | Sourcify |
|---|---|---|
| CallMarketCovered calls: escrow, buy, exercise, expire | 0xb675…df80 | Full match #58463816 |
| PutMarketCash-secured puts: escrow, buy, exercise, expire | 0x2E2d…cb35 | Full match #58463839 |
| RouterETH entry point that wraps, calls a market and refunds | 0xdD76…DF68 | Full match #58463883 |
| OptionNFTERC-721 that represents each filled option | 0xe0cd…308b | Full match #58463804 |
| AssetRegistryToken whitelist, caps and minimum strikes | 0x02f5…658D | Full match #58327992 |
| FeeVaultCollects fees and splits them each epoch | 0x78c5…ddef | Full match #57936203 |
| StakingPool$KYTE staking and WETH rewards | 0xD725…d17f | Full match #58609771 |
| BuybackBurnerOn-chain buyback and burn (not in use; buybacks are manual) | 0x8a9d…fb95 | Full match #58609773 |
| UniswapV4AdapterSwap route used by BuybackBurner | 0xfa17…dda6 | Full match #58609785 |
| KyteHookUniswap v4 hook: TWAP oracle and protocol fee | 0x77e5…9044 | Full match #57936350 |
| KyteHaltGateReader of Harmonic's session oracle (not called by live contracts) | 0x3Ba4…bc8b | Full match #58822304 |
| TimelockControllerOpenZeppelin timelock that owns settings (configuration reviewed) | 0xf8e6…2893 | Full match #57936139 |
Roles and privileges
Who can change what. Nobody can move escrowed collateral or staked $KYTE.
Minimum delay 600 s (10 min). Administers itself; the deployer holds no role. Sets fees within hard caps, Router, guardian, listings, fee destinations and split, unpause.
Safe, 3 owners, threshold 1. Can pause new exposure or switch a listing off. Cannot unpause, enable anything or move funds.
Safe, 3 owners, threshold 2. Receives the operations share (50%) of each fee split. No protocol permissions.
Externally owned account. Only BuybackBurner.buyAndBurn, within on-chain bounds. Not used: buybacks are manual.
Method and reproduction
Verified sources and compiler settings were taken from Sourcify for every address. Each contract was analysed with the settings of its own deployment (solc 0.8.28 or 0.8.26, via-IR, 200 optimiser runs, cancun). Every tool result was read against the code and classified as a finding, accepted design or false positive. Live settings were read through a public RPC at the snapshot block.
The unedited Slither (JSON and text) and Aderyn (Markdown) outputs for every contract, the scope file and the on-chain snapshot are in the raw archive above. Exact commands are in section 13 of the report.
- kyte-security-self-assessment.pdf
- 5ada21efbe57ec0296a2f216f21f262df9e9e00e66d4581b5c7d749303a9969a
- kyte-security-self-assessment-raw.zip
- 69cc67a0e5096b1a92263f76901c726f155ef97cc0286add23bf48c91399499f
- report.html
- 978a28242bbbaffd7ef02663ca4f2c555e5670872a55af91cc0dbde3381df22e
Kyte · Security Self-Assessment v1.1, 9 November 2026. Provided for information only. This is not an audit, an endorsement or investment advice. Options can expire worthless. Read the rules and risks.