DCA.fun
Upgradeability

Differential audit of code changes since the prior NM-0563 review, focused on moving constructor logic into initializer functions.

report id

0640

1 Executive Summary

This document presents the results of a security review conducted by Nethermind Security for DCA.fun. DCA.fun is a decentralized infrastructure protocol designed to provide users with the tools to automate Dollar Cost Averaging (DCA) investment strategies on-chain. The project's primary goal is to offer a non-custodial and trust-minimized alternative to centralized platforms, allowing users to execute systematic investment plans while retaining full control over their assets.

The primary focus of this security review was a differential audit of the DCA.fun smart contract suite, examining the specific changes introduced since the previous assessment, NM-0563. The scope was strictly limited to the code changes between the final commit of the previous audit (7abd623) and the new codebase state at commit 72db329 for this audit, NM-0640. The key modifications involved refactoring the contract setup process by moving initial configuration logic from constructors into initializer functions and setters. This architectural shift is intended to facilitate a simpler and more flexible deployment process, particularly for deployments to deterministic addresses.

The audit comprises 1352 lines of Solidity code. The audit was performed using (a) manual analysis of the codebase, and (b) automated analysis tools.

Audit assessment
Audit Type	Security Review
Final Report	September 8, 2025
Initial Commit	`72db329418`
Final Commit	`3193689e8c`
Documentation Assessment	High
Test Suite Assessment	High

Total findings: 1
Fixed: 1
Acknowledged: 0
Mitigated: 0
Unresolved: 0

Findings by severity

Critical0
High0
Medium0
Low0
Informational1
Best Practices0

2 Audited Files

#	Contract	LoC	Comments	Ratio	Blank	Total
1	`src/dcaDotFun/DcaDotFun.sol`	353	79	22.4%	80	512
2	`src/dcaDotFun/DcaVaultFactory.sol`	64	25	39.1%	18	107
3	`src/dcaDotFun/DcaVault.sol`	165	48	29.1%	43	256
4	`src/dcaDotFun/interfaces/IFillOrderCallback.sol`	4	6	150.0%	1	11
5	`src/dcaDotFun/interfaces/IDcaVault.sol`	61	95	155.7%	26	182
6	`src/dcaDotFun/interfaces/IDcaDotFun.sol`	132	148	112.1%	28	308
7	`src/dcaDotFun/interfaces/IDcaVaultFactory.sol`	25	37	148.0%	11	73
8	`src/verifierDotFun/VerifierDotFun.sol`	78	38	48.7%	31	147
9	`src/verifierDotFun/libraries/VerifierLib.sol`	46	11	23.9%	10	67
10	`src/verifierDotFun/interfaces/IVerifierDotFun.sol`	56	59	105.4%	16	131
11	`src/verifierDotFun/interfaces/IVerifierProxy.sol`	14	15	107.1%	4	33
12	`src/verifierDotFun/interfaces/IFeeManager.sol`	10	11	110.0%	5	26
13	`src/dotFun/DotFun.sol`	229	105	45.9%	67	401
14	`src/dotFun/libraries/AaveConstants.sol`	25	2	8.0%	12	39
15	`src/dotFun/interfaces/IDotFun.sol`	83	103	124.1%	26	212
16	`src/interfaces/IWETH.sol`	7	15	214.3%	4	26
	Total	1352	797	58.9%	382	2531

*The scope of the audit was strictly limited to the code changes between the final commit of the previous audit (7abd623) and the new codebase state at commit 72db329 for this audit, NM-0640.

3 Summary of Issues

#	Finding	Severity	Update
1	Key configuration variables should be set atomically upon deployment	Info	Fixed

4 System Overview

No system overview is included in this report.

5 Risk Rating Methodology

The risk rating methodology used by Nethermind Security follows the principles established by the OWASP Foundation. The severity of each finding is determined by two factors: Likelihood and Impact.

Likelihood measures how likely the finding is to be uncovered and exploited by an attacker. This factor will be one of the following values:

High: the issue is trivial to exploit and has no specific conditions that need to be met;
Medium: the issue is moderately complex and may have some conditions that need to be met;
Low: the issue is very complex and requires very specific conditions to be met.

When defining the likelihood of a finding, other factors are also considered. These can include but are not limited to motive, opportunity, exploit accessibility, ease of discovery, and ease of exploit.

Impact is a measure of the damage that may be caused if an attacker exploits the finding. This factor will be one of the following values:

High: the issue can cause significant damage, such as loss of funds or the protocol entering an unrecoverable state;
Medium: the issue can cause moderate damage, such as impacts that only affect a small group of users or only a particular part of the protocol;
Low: the issue can cause little to no damage, such as bugs that are easily recoverable or cause unexpected interactions that cause minor inconveniences.

When defining the impact of a finding, other factors are also considered. These can include but are not limited to data and state integrity, loss of availability, financial loss, and reputation damage. After defining the likelihood and impact of an issue, the severity is determined according to the table below.

Impact / Likelihood	Low	Medium	High
High	Medium	High	Critical
Medium	Low	Medium	High
Low	Info / Best Practices	Low	Medium
Undetermined	Undetermined	Undetermined	Undetermined

To address issues that do not fit a High, Medium or Low severity, Nethermind Security also uses three more finding severities: Informational, Best Practices, and Undetermined.

Informational findings do not pose any risk to the application, but they carry some information that the audit team intends to pass to the client formally;
Best Practice findings are used when some piece of code does not conform with smart contract development best practices;
Undetermined findings are used when we cannot predict the impact or likelihood of the issue.

6 Issues

6.1 Key configuration variables should be set atomically upon deployment

File	Fix commit	Type	Status
`src/dcaDotFun/DcaDotFun.sol`	—	Info	Fixed

Across multiple contracts in the scope of the audit, constructors have been simplified. Previously, they were responsible for initializing a comprehensive set of configuration parameters, ensuring that each contract was deployed in a fully configured and operational state.

For example, the constructor in the DcaDotFun contract used to set critical addresses, slippage parameters, and fee splits. The new implementation now only handles minimal setup, such as setting the PERMIT2 address and granting administrative roles.

constructor(address owner_, address permit2_) {
    _PERMIT2 = permit2_;
    _grantRole(DEFAULT_ADMIN_ROLE, owner_);
    _grantRole(PAUSER_ROLE, owner_);
}

This pattern of moving initialization logic from the constructor to individual setter functions is present in other contracts as well. It shifts the responsibility of configuration to the deployer, who must now execute a series of separate transactions after deployment. This creates a time window where contracts are live on-chain but not fully configured. If a user interacts with a contract during this period, it may operate with default zero-values for critical parameters, leading to unintended behavior.

Recommendation

Consider the risks associated with the multi-transaction initialization process. This approach is susceptible to human error and can leave contracts in an inconsistent state if the deployment and configuration script is interrupted or improperly executed. It is advised to carefully evaluate this strategy and ensure that robust, atomic deployment procedures are in place to prevent any period where contracts are live but misconfigured.

Resolution

We acknowledge this finding and have implemented a safeguard by setting isCreateOrderPaused to true in the constructor, preventing any user interactions until the contract is fully configured. This approach allows us to maintain our gas optimization strategy (1 million optimizer runs) while ensuring contracts cannot be used in an incomplete state. Once all configuration parameters are properly set and verified, we will unpause the contract to enable normal operations.

7 Documentation Evaluation

Software documentation refers to the written or visual information that describes the functionality, architecture, design, and implementation of software. It provides a comprehensive overview of the software system and helps users, developers, and stakeholders understand how the software works, how to use it, and how to maintain it. Software documentation can take different forms, such as user manuals, system manuals, technical specifications, requirements documents, design documents, and code comments. Software documentation is critical in software development, enabling effective communication between developers, testers, users, and other stakeholders. It helps to ensure that everyone involved in the development process has a shared understanding of the software system and its functionality. Moreover, software documentation can improve software maintenance by providing a clear and complete understanding of the software system, making it easier for developers to maintain, modify, and update the software over time. Smart contracts can use various types of software documentation. Some of the most common types include:

Technical whitepaper: A technical whitepaper is a comprehensive document describing the smart contract’s design and technical details. It includes information about the purpose of the contract, its architecture, its components, and how they interact with each other;
User manual: A user manual is a document that provides information about how to use the smart contract. It includes step-by-step instructions on how to perform various tasks and explains the different features and functionalities of the contract;
Code documentation: Code documentation is a document that provides details about the code of the smart contract. It includes information about the functions, variables, and classes used in the code, as well as explanations of how they work;
API documentation: API documentation is a document that provides information about the API (Application Programming Interface) of the smart contract. It includes details about the methods, parameters, and responses that can be used to interact with the contract;
Testing documentation: Testing documentation is a document that provides information about how the smart contract was tested. It includes details about the test cases that were used, the results of the tests, and any issues that were identified during testing;
Audit documentation: Audit documentation includes reports, notes, and other materials related to the security audit of the smart contract. This type of documentation is critical in ensuring that the smart contract is secure and free from vulnerabilities.

These types of documentation are essential for smart contract development and maintenance. They help ensure that the contract is properly designed, implemented, and tested, and they provide a reference for developers who need to modify or maintain the contract in the future.

8 Remarks & Test Suite

The DCA.fun team provided comprehensive documentation for the protocol. The codebase is well-documented with detailed NatSpec comments, and the project's README.md file offers a clear overview of the system's architecture, core components, and user flows. Furthermore, the team was highly responsive and available for internal sync calls, promptly addressing all questions and discussion points raised by the Nethermind Security team. This collaborative approach provided valuable insights and ensured a thorough understanding of the protocol's technical aspects throughout the engagement.

All the relevant issues raised by the AuditAgent have been incorporated into this report. The AuditAgent is an AI-powered smart contract auditing tool that analyses code, detects vulnerabilities, and provides actionable fixes. It accelerates the security analysis process, complementing human expertise with advanced AI models to deliver efficient and comprehensive smart contract audits. Available at https://app.auditagent.nethermind.io.

Test suite

208Tests passed

0Failed

The complete test output is in the full report.

General advisory to clients

As auditors, we recommend that any changes or updates made to the audited codebase undergo a re-audit or security review to address potential vulnerabilities or risks introduced by the modifications. By conducting a re-audit or security review of the modified codebase, you can significantly enhance the overall security of your system and reduce the likelihood of exploitation. However, we do not possess the authority or right to impose obligations or restrictions on our clients regarding codebase updates, modifications, or subsequent audits. Accordingly, the decision to seek a re-audit or security review lies solely with you.

Disclaimer

This report is based on the scope of materials and documentation provided by you to Nethermind in order that Nethermind could conduct the security review outlined in 1. Executive Summary and 2. Audited Files. The results set out in this report may not be complete nor inclusive of all vulnerabilities. Nethermind has provided the review and this report on an as-is, where-is, and as-available basis. You agree that your access and/or use, including but not limited to any associated services, products, protocols, platforms, content, and materials, will be at your sole risk. Blockchain technology remains under development and is subject to unknown risks and flaws. The review does not extend to the compiler layer, or any other areas beyond the programming language, or other programming aspects that could present security risks. This report does not indicate the endorsement of any particular project or team, nor guarantee its security. No third party should rely on this report in any way, including for the purpose of making any decisions to buy or sell a product, service or any other asset. To the fullest extent permitted by law, Nethermind disclaims any liability in connection with this report, its content, and any related services and products and your use thereof, including, without limitation, the implied warranties of merchantability, fitness for a particular purpose, and non-infringement. Nethermind does not warrant, endorse, guarantee, or assume responsibility for any product or service advertised or offered by a third party through the product, any open source or third-party software, code, libraries, materials, or information linked to, called by, referenced by or accessible through the report, its content, and the related services and products, any hyperlinked websites, any websites or mobile applications appearing on any advertising, and Nethermind will not be a party to or in any way be responsible for monitoring any transaction between you and any third-party providers of products or services. As with the purchase or use of a product or service through any medium or in any environment, you should use your best judgment and exercise caution where appropriate. FOR AVOIDANCE OF DOUBT, THE REPORT, ITS CONTENT, ACCESS, AND/OR USAGE THEREOF, INCLUDING ANY ASSOCIATED SERVICES OR MATERIALS, SHALL NOT BE CONSIDERED OR RELIED UPON AS ANY FORM OF FINANCIAL, INVESTMENT, TAX, LEGAL, REGULATORY, OR OTHER ADVICE.

DCA.funUpgradeability

1

Executive Summary

2

Audited Files

3

Summary of Issues

4

System Overview

5

Risk Rating Methodology

6

Issues

6.1 Key configuration variables should be set atomically upon deployment

7

Documentation Evaluation

8

Remarks & Test Suite

DCA.fun
Upgradeability