Code complexity vs audit coverage
BENQI's assessment for RD-F-024 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Core lending: ~23 Solidity files, estimated 2,000-3,000 LOC total. Halborn 2021 engagement appears adequate for this scope. Certora FV on StakedAvax: 2-month engagement for a bounded contract — adequate. Cyfrin Ignite 2025: 1,367 LOC across 4 files in 2-week competitive contest. Main concern: Isolated Markets (Moonwell-lineage, larger codebase with multi-reward distributor and additional complexity) are claimed to have 'dedicated 2024 audit coverage' but no public PDF is accessible. If the Isolated Markets audit is adequate, scoring would be green. The inaccessibility of that audit PDF creates uncertainty. Yellow: audit appears adequate for the publicly-audited components but coverage of the Isolated Markets delta is unverifiable.
Sources #
- AuditCyfrin BENQI Ignite Audit — scope and LOCCyfrin Ignite audit scope: 1,367 LOC / 2-week contest periodretrieved 2026-05-16
- Certora BENQI sAVAX — 2-month FVCertora sAVAX FV — 2-month engagement (Feb-April 2022) for StakedAvax.solretrieved 2026-05-16
Methodology #
Determine whether the cyclomatic complexity or LOC-per-audit-day ratio exceeds the curator-declared credibility threshold for the audit to be meaningful.
See the full factor methodology and distribution across all protocols →