QuantumPoolsAudit & Security
An outside security firm, Hashlock, reviewed the vault contract and rated it Secure (September 2026). This page links the report, shows what they covered, what the code already does to protect you, and which facts you can read on-chain yourself.
The 20-second version
- Hashlock completed its review in September 2026 and rated the vault Secure. Every owner action waits 48 hours behind a multisig Safe (2-of-2 on most chains, 2-of-3 on Robinhood Chain); Hashlock notes that control of the protocol still remains with the core team. Read the final PDF report ↗
- Hashlock found 2 Medium, 3 Low and 1 QA issue, all resolved. Hashlock verified that the live vaults on Robinhood Chain and Base run the fixed code (commit f2ca3d2).
- Pause can't block your exit, the keeper can't take your funds, and every owner change waits 48 hours in public.
- Public deposits are open on the live venues: Robinhood Chain, Base and BNB Chain. Other chains show as previews until their vaults go live.
Audited. Rated Secure by Hashlock.
Hashlock finished its review in September 2026, rated the vault Secure, and placed the project at the Decentralised end of its centralisation scale. The report also notes that every owner action sits behind a 48-hour timelock and a 2-of-2 Safe, and that control of the protocol remains with the core team. The final report is public, here and on Hashlock's site ↗. Even a finished audit cannot promise the code has no bugs — read the report and check the on-chain facts yourself.
The contract under review lives here. Tap to copy, or open it on the explorer:
QuantumVaultV2 · Robinhood Chain (chain ID 4663) · deployed Sep 25, 2026 · runtime code 23,370 bytes. The same code is live on Base at 0x9597…386B.
What Hashlock audited
Six files, 2,710 lines. The vault itself is about two-thirds of it. The rest are four helper libraries and the list of DEX functions the vault calls.
| File | Its job | Lines |
|---|---|---|
QuantumVaultV2.sol | Positions, snuggles, fee, pause, ownership | 1,850 |
PositionQueue.sol | Holds top-ups until the next snuggle | 278 |
VaultMath.sol | Range math and price reads | 243 |
IUniswapV3.sol | DEX functions the vault may call | 144 |
VenueAdapter.sol | Opens and closes DEX positions | 98 |
FeeRouter.sol | Routes earned fees per your setting | 97 |
| Total | About 1,515 lines without blanks and comments | 2,710 |
Also read, not counted: DeployV2.s.sol, only to check which roles were assigned at launch.
These are not covered. If you rely on one of them, the review says nothing about it.
- This website and the QuantumPools app.
- The keeper bot (Hashlock added one informational note on it, Q-01, now resolved).
- Our Solana programs. They have not been audited.
- The V2.1 vaults (one-signature
depositWithStrategy), deployed from October 2026 onward. Their changes are in pre-review for Hashlock and are not covered by this report yet. - The retired V1 vault and older test vaults.
What Hashlock found
Hashlock reported 2 Medium, 3 Low and 1 QA finding, with no High or Critical. Every one is resolved: the fixes are in commit f2ca3d2, and Hashlock checked each fix.
| ID | Severity | What it was | Status |
|---|---|---|---|
M-01 | Medium | A queued width or delay change was dropped during a snuggle, so the new position kept the old settings. | Resolved |
M-02 | Medium | The out-of-range wait was not measured over one continuous stretch, so a snuggle could come early. | Resolved |
L-01 | Low | A valid zero-fee setting could be mistaken for "not set" and replaced with the default. | Resolved |
L-02 | Low | The default build settings pinned library addresses, a deployment-safety risk. | Resolved |
L-03 | Low | Fee rounding: on very small fee collections the protocol's fee could round down by a fraction of a cent. Fixed. Your fees and deposit were never affected. | Resolved |
Q-01 | QA | Keeper reliability (off-chain, no funds involved). Resolved in the audited fix; a follow-up hardening is under Hashlock review. | Resolved |
Full details, code excerpts and Hashlock's recommendations are in the final report (PDF) and on Hashlock's Quantum Pools page ↗.
Deployed contracts Hashlock verified
Hashlock confirmed that both live vaults run the fixed code (f2ca3d2), differing only in each chain's Uniswap V3 addresses, and that both use the libraries below.
| Contract | Network | Address |
|---|---|---|
| QuantumVaultV2 (live) | Robinhood Chain | 0x5433f385F538Fa11b8A25B82230a306d25dF8EB3 |
| QuantumVaultV2 (live) | Base | 0x9597f68203d1bc85744A5Fc11D890aA7777e386B |
| FeeRouter | Robinhood Chain, Base | 0xF383d5408Aa36005B59952a05cE84D098e54C9f2 |
| PositionQueue | Robinhood Chain, Base | 0xC6Fe2Ac3b6Ba2b089F263324634aF37E45E3993F |
| VaultMath | Robinhood Chain, Base | 0x9b6D35FA063ddB11d7e59ef00454C9134e211940 |
| VenueAdapter | Robinhood Chain, Base | 0xb4ACC0209fC349EC509362CcA7d5fC4C5719dc60 |
| QuantumVaultV2 (superseded, pre-fix) | Robinhood Chain | 0x07c688E3C1d606edc7Fe428862C08c3FA9aAEb3B · paused, do not use |
Who audited us: Hashlock
Hashlock is an Australian security firm (Hashlock Pty Ltd) that does manual, line-by-line smart contract audits. In its own words: "We collaborate with blockchain developers, project creators and corporations to ensure that web3 innovations are secure and successful."
Hashlock is a member of
Some of the projects Hashlock has audited
1inchEthereum · DeFi · Liquidity networkMar 2026
SushiSwapEthereum · DeFi · DEXMay 2025
GalaEthereum, Solana · DeFi · DEXJun 2025
Rocket PoolEthereum · StakingJan 2026
EigenLayerEthereum · Staking (competition)Mar 2025
VanaEVM · AI · DataJul 2025
Energy WebEthereum, Substrate · EnterpriseNov 2025
ManifestCosmos · DePINApr 2025Source: hashlock.com/audits. Names and logos belong to their owners and are shown only to illustrate Hashlock's track record; these projects are not affiliated with QuantumPools and do not endorse it. Our own listing: hashlock.com/audits/quantum-pools ↗.
What you can check on-chain
You don't have to take our word for the basics. Anyone can read these values straight from the chain, with no account and no access.
| Who owns the vault? | owner() → the timelock, 0x41D3…27AC |
|---|---|
| How long must owner changes wait? | getMinDelay() on the timelock → 172,800 s (48 hours) |
| What is the fee today? | performanceFeeBps() → 1500 (15%) |
| Is it paused? | paused() → false |
| How many pools? | poolCount() → 2 |
With Foundry installed, each one is a single command. For example:
audit-hashlock-2026-09-11 (commit 6ccce2e, dated Sep 9, 2026); the deployed vault applies Hashlock's round-1 fixes on top of that (commit f2ca3d2). The on-chain bytecode matches that fixed source.Safety controls in the code
Each card says what a control does for you. The small code tag under it shows where it sits in the contract. Pick who you want to be protected from.
- Exit has no off switch
- A pause can't freeze your funds. Withdrawals keep working while the vault is paused, with no lock-up or approval step.
withdraw,withdrawTo,withdrawFraction - Your settings are yours
- Only you can withdraw, harvest, compound, or change your position's width, delay and fee routing. If you turn auto-snuggle on, the keeper can snuggle it for you. Our published fee is at most 15% of the trading fees your LPs earn, never your deposit (up to 25% only when you copy another member's LP position); fee increases wait 48 hours in public.
_requireOwner - Fee payout can't jam your exit
- If a fee recipient can't receive tokens, the cut is held in the vault and your withdrawal still goes through.
_payTo,claimProtocolFees
- The keeper can't take your funds
- It can only advance the snuggle steps on positions whose owner turned auto-snuggle on, and lower a wallet's fee rate. It cannot withdraw, harvest, compound, choose ticks or amounts, or receive your tokens.
executeKeeperAction,setUserFee - No swap inside a snuggle
- The contract has no swap code, so a snuggle pays no swap fee.
_recenter - Two price checks must agree
- A 30-minute average price decides that you left your range, and the current price must agree. The new range is placed from the current price. A deposit or snuggle (keeper or manual) is refused when the current price is more than about 10.5% (1,000 ticks) away from the 30-minute average.
_keeperAction,_rebalanceAuto - Automation is your choice
- Auto-snuggle is set per position, and you can turn it off at any time, even while the vault is paused. You set the wait, from zero up to 7 days.
setStrategy
- Two signatures, then 48 hours
- Each owner action needs both cofounders to sign (a 2-of-2 Safe), then waits 48 hours where anyone can see it.
Safe (2 of 2) → Timelock → Vault - No upgrade button
- There is no proxy, so the code cannot be swapped for new code. Settings can still change through the timelock.
constructor,immutablefields - Fee guardrails
- Our published fee: liquidity pools at most 15%, only from the trading fees your LPs earn, never your deposit. Copy trading up to 25%, only when you copy another member's LP position. Referring friends lowers your own fee 1% per friend with an open position worth $500+ (back up if they close out), with no cap (floor 0%), and routes 1% of each active friend's fees to you out of our 15%, never an extra charge to them.
- Default rate: moves at most 5 points per change, once every 6 hours.
- One wallet's own rate (for example copy trading): set behind the 48-hour public wait. The keeper can only lower it.
setPerformanceFee,setUserFee - Narrow pause
- Pause stops new deposits, top-ups, keeper actions and manual snuggles. It does not stop withdrawals, harvest, compound or setting changes.
whenNotPaused
- The code can still have bugs, audit or not.
- A snuggle sets your new range at today's price, even in the middle of a swing. The snuggle is itself a public transaction, so outside traders can still front-run it or "sandwich" it (trade just before and just after it) in the pool.
- The 48-hour wait slows us down too. Pausing or removing a misbehaving keeper takes at least two days.
Who can do what
Three parties can call the vault. Here is how their powers line up.
| Action | You | Keeper | Owner (Safe + timelock) |
|---|---|---|---|
| Withdraw your position | Any time | No | No |
| Harvest or compound your fees | Yes | No | No |
| Snuggle | Yes, skipping your delay, only while out of range and not paused; you pay the gas | Only if you switched auto on, after your delay | No |
| Set your snuggle range width | Yes, with your width setting | No | No |
| Change the fee | No | Can only lower a wallet's rate | Can change the default and per-wallet rates (published: 15% on LPs, 25% copy trading). Always after a 48 h public wait |
| Change treasury, referrer, keepers, pools, limits | No | No | Yes, after 48 h |
| Pause deposits and automation | No | No | Yes, after 48 h |
| Replace the contract code | No | No | No |
The two contracts that control owner actions, if you want to keep an eye on them:
Tell us privately first
Email admin@quantumpools.io with SECURITY in the subject line.
- What's affected. The contract address or page URL.
- How to reproduce it. Steps, a transaction hash, or a short proof of concept.
- The impact. What an attacker could do, and to whose funds.
Quick answers
If QuantumPools disappeared, could I still get my money out?
Yes. Your funds sit in the vault contract on-chain — on the chain where you opened your position — not with us, so you can withdraw directly at any time. A withdrawal only needs your own wallet and the vault contract: it can't be paused, and it doesn't depend on the keeper or the website. You do need a way to send the transaction, and a lost wallet can't be recovered.
Can I deposit now?
Yes. Public deposits are open on the live venues: Robinhood Chain, Base and BNB Chain. Venues marked as previews on the Add page are not open yet.