Security · 13 October 2026 · 6 min read
We reviewed our own contracts. Here's everything we found.
Parabol² went live on Robinhood Chain this week. A lot of you asked the right question: "audit next?" Before we hire someone else to look, we read every line ourselves. We're publishing what we found, including the parts that don't make us look good.
What we looked at
We reviewed every smart contract that holds or moves money in Parabol², exactly as deployed on mainnet: about 4,800 lines of Solidity. We split it into four parts and reviewed them in parallel:
- Bull²: the engine that prices squared upside, and the vault that pays it out and hedges it on Uniswap.
- Bear²: the engine and the fully reserved vault behind squared downside.
- The router that packages VOL² and Protect, plus the market-hours calendar.
- Roles and deployment: who can change what, and whether the launch left anything behind.
When a finding could cost someone money, we didn't stop at an argument. We wrote a test that reproduces it on a local chain. When a finding was about how mainnet is set up, we checked the live contracts directly.
The results
Plus 17 informational notes. No finding lets anyone take user funds directly, mint tokens or take over the contracts. But "no critical bugs found" is not the same as "safe", and seven mediums is a real list. Here are the ones that matter most, in plain words.
1. The weekend price is a free option
Stock price feeds pause from Friday evening to Sunday evening (New York time), but the stocks keep trading on 24/7 venues. We never block sells, on purpose, so you can always exit. That also means someone can sell at Friday's price after the stock has moved against them over the weekend. If it moves their way, they just wait for Monday. The vault, and the people who fund it, pay for that option.
Fix: sells stay open, but once the price is a few hours old they get a wider, more defensive price.
2. A safety switch that isn't switched on
When the Bull² vault has to sell part of its stock hedge to pay a seller, the code has a guard against someone pushing the pool price down first. On mainnet that guard was never turned on. Our test shows what that costs: in a 1,000,000 USDG vault, one transaction could take about 2.8% of the vault.
Fix: a governance transaction, no new code needed. It comes first.
3. Too much power in a few places
Three of the findings are about our own permissions:
- The emergency "guardian" key can re-open Bull² buys after governance pauses them, which it shouldn't be able to do.
- Governance can set Bull² carry to any number, with no upper limit.
- The wallet that deployed the contracts still holds one minor role on the Bull² vault, which it was supposed to give up.
None of these let anyone take funds today, but you shouldn't have to trust us that much.
Fix: hard limits written into the code, and a 48-hour timelock on every change.
4. Two problems that are waiting to happen
Two findings can't hurt anyone right now, but they would once the vaults grow or open up.
- Bear²'s "always fully reserved" rule can be slightly breached when the market closes, because carry is projected at the wrong rate. With today's settings that's a 0.065% breach and the vault stays solvent. With looser settings it could become a real shortfall.
- When a market is paused, someone leaving a vault can be paid out at a price that's too generous, at the expense of the providers who stay. Today the only vault provider is Parabol itself.
Both get fixed before the vaults open to outside deposits.
How much is actually at risk today
Very little, by design. Each vault holds about 24 USDG, trades are capped at 50 USDG, and vault deposits are not open to the public yet. For every finding in this review, the most anyone could gain or lose today is cents to a few dollars.
That's why we launched small. Mainnet is early access. These numbers only go up after the fixes are in and the independent audit is done.
What held up
A review should also say what it checked and found solid. These are the guarantees we built Parabol² around, and they survived:
- You can always sell. No pause, limit or market state blocks a sell.
- Trading back and forth can't drain a vault. Every rounding favours the vault, and a round trip always costs at least the spread and fee.
- Bear² checks cash on every trade. Every Bear² buy is checked against the cash needed for the worst-case payout (apart from the edge case in point 4).
- Only the engines move money. Only they can mint, burn or pay out, and only governance (a 2-of-3 multisig) can upgrade.
- Common attacks didn't work. No reentrancy paths, no first-depositor attack, no way to move vault value through Uniswap pools, and no way to spend someone else's VOL² or Protect receipt.
What happens next
- First: the governance-only fixes. Remove the deployer's leftover role (already prepared), switch on the price guard (point 2) and shrink the paused-sell budget.
- Next upgrade: defensive weekend pricing; guardian can pause but not unpause; hard limits on carry and price age; Bear²'s reserve calculation fixed; vault exits blocked while a market is paused.
- Then: a 48-hour timelock in front of governance, and corrected security documentation.
- Then the independent audit. We'll publish it in full, like this one.
Every finding has a status on the full report, and we'll update it as fixes go live, each one with its transaction.
What this means for you
Parabol² is live, it works, and the core guarantees held up when we went looking for problems. It is also new, unaudited software. Trade amounts you can afford to lose, and keep an eye on this page.
If you find something we missed, DM @ParabolNow. Please don't test it on mainnet.