Bounce Tech
Preparing a leveraged token index for public launch on Hyperliquid. 16 findings across vault valuation, MEV surfaces, and reward accounting, every high and medium fixed.
About the client
Bounce Tech is a leveraged token protocol that creates synthetic leveraged exposure to perpetual futures markets on Hyperliquid.
Users can mint and redeem leveraged tokens (like "ETH 10x Long") that automatically maintain target leverage ratios through integration with Hyperliquid's perpetual trading infrastructure, while earning fees that get distributed to BOUNCE token stakers.
"Phage provided a thorough and insightful audit for Bounce Tech that uncovered valuable findings. They were a pleasure to work with and allowed us to deliver our product with confidence."
CHASE MANNING, LEAD DEVELOPER AT BOUNCE TECHThe team on this audit
Lead Security Researcher at Sherlock. Over 100 audits performed and 500+ bugs found.
Lead Security Researcher at Sherlock. Over 15 Top3 finishes in audit contests and multiple bug bounties.
A promising Security Researcher. In the space for ~1 year, and showing remarkable results.
High severity issues and fixes
Spot and perp balance is not considered for calculating vault value
Vault valuation ignored spot and perp balances, so the protocol operated on a wrong TVL and its internal accounting drifted from reality.
Spot and perp balances are now tracked and included in the vault value calculation.
Stepwise jumps occur upon spot/perps balance top-ups, allowing MEV attacks
Balance top-ups moved the vault value in stepwise jumps that MEV bots could exploit to grief balance changes.
A mapping now tracks in-between balances so top-ups no longer produce an exploitable jump.
Position value is computed incorrectly for shorts
Short positions were valued incorrectly, producing wrong position values that corrupted the vault's internal accounting.
The valuation math was changed to also account for short positions.
Unstaking operations are not validated against the creator
Users must wait before executing a withdrawal, but the claim could be front-run and executed by any other user.
Withdrawal execution is now validated against the user who created it.
Plus 7 medium and 5 low severity findings. All documented in the full report.
Why Phage Security
Bounce Tech picked Phage for our ability to catch elusive edge cases and navigate the unique patterns of the Hyperliquid ecosystem. Four high severity accounting and MEV issues were found and fixed before launch, leaving the codebase thoroughly prepared. The team came back for a second engagement in April 2026.