ENSO Finance ~ Flashloan Adapters

Smart Contract Security Assessment

February 02, 2026

SUMMARY​

ABSTRACT​

Dedaub was commissioned to perform a security audit of the flashloan adapters to be added within the Enso Shortcuts ecosystem. The intent behind the newly introduced functionality is for users to be able to compose complex on-chain actions powered by the Enso Shortcut system within the context of flashloan operations.

SETTING & CAVEATS​

This audit report mainly covers the contracts located in the public repository of the protocol https://github.com/EnsoBuild/shortcuts-client-contracts, on branch flashloan at commit 4aa5579d3c1f1d1c6f9792abad2c85386f55c0ee. The changes can be collectively viewed at the following pull request: https://github.com/EnsoBuild/shortcuts-client-contracts/pull/26

Audit Start Date: January 29, 2026

Audit End Date: January 30, 2026

Report Submission Date: February 02, 2026

2 auditors worked on the following contracts:

The audit’s main target is security threats, i.e., what the community understanding would likely call "hacking", rather than the regular use of the protocol. Functional correctness (i.e. issues in "regular use") is a secondary consideration. Typically it can only be covered if we are provided with unambiguous (i.e. full-detail) specifications of what is the expected, correct behavior. In terms of functional correctness, we often trusted the code’s calculations and interactions, in the absence of any other specification. Functional correctness relative to low-level calculations (including units, scaling and quantities returned from external protocols) is generally most effectively done through thorough testing rather than human auditing.

The introduced functionality directly integrates with various protocols that offer flashloan capabilities:

• Morpho
• Aave V3
• Balancer V3
• Dolomite

This meant that the auditors expended significant effort towards understanding all the security assumptions of each third party protocol and determining whether the security of the protocol can be impacted.

VULNERABILITIES & FUNCTIONAL ISSUES​

This section details issues affecting the functionality of the contract. Dedaub generally categorizes issues according to the following severities, but may also take other considerations into account such as impact or difficulty in exploitation:

Issue resolution includes “dismissed” or “acknowledged” but no action taken, by the client, or “resolved”, per the auditors.

CRITICAL SEVERITY​

[No critical severity issues]

HIGH SEVERITY​

[No high severity issues]

MEDIUM SEVERITY​

[No medium severity issues]

LOW SEVERITY​

[No low severity issues]

OTHER / ADVISORY ISSUES​

This section details issues that are not thought to directly affect the functionality of the project, but we recommend considering them.

...
IUniswapV3Pool pool = IUniswapV3Pool(msg.sender);
address factory = pool.factory();
_verifyLender(factory, LenderProtocol.UniswapV3);

// NOTE: this might be redundant since we get the factory to verify lender
uint24 poolFee = pool.fee();

address expectedPool = IUniswapV3Factory(factory).getPool(params.token0, params.token1, poolFee);
if (msg.sender != expectedPool) {
    revert UnknownLender();
}
...

...
balanceBefore = IERC20(token).balanceOf(address(this)) - amount;
...

...
balancesBefore[i] = IERC20(tokens[i]).balanceOf(address(this)) - amounts[i];
...

function onMorphoFlashLoan(uint256 amount, bytes calldata data) external {
    _verifyLender(msg.sender, LenderProtocol.Morpho);

    (
        address wallet,
        IERC20 token,
        bytes32 accountId,
        bytes32 requestId,
        bytes32[] memory commands,
        bytes[] memory state
    ) = abi.decode(data, (address, IERC20, bytes32, bytes32, bytes32[], bytes[]));

/*
  @Dedaub:

  Assume that a vulnerability on the morpho contract allowed someone to call into the adapter with arbitrary data
*/
    uint256 balanceBefore = executeShortcut(wallet, accountId, requestId, commands, state, address(token), amount);
...

function removeLender(address lender) external onlyOwner {
  trustedLenders[lender] = LenderProtocol.None;
  emit LenderRemoved(lender);
}

DISCLAIMER​

The audited contracts have been analyzed using automated techniques and extensive human inspection in accordance with state-of-the-art practices as of the date of this report. The audit makes no statements or warranties on the security of the code. On its own, it cannot be considered a sufficient assessment of the correctness of the contract. While we have conducted an analysis to the best of our ability, it is our recommendation for high-value contracts to commission several independent audits, a public bug bounty program, as well as continuous security auditing and monitoring through Dedaub Security Suite.

ABOUT DEDAUB​

Dedaub offers significant security expertise combined with cutting-edge program analysis technology to secure some of the most prominent protocols in DeFi. The founders, as well as many of Dedaub's auditors, have a strong academic research background together with a real-world hacker mentality to secure code. Protocol blockchain developers hire us for our foundational analysis tools and deep expertise in program analysis, reverse engineering, DeFi exploits, cryptography and financial mathematics.