NIST 800-53 · FLARE NETWORK · 5 PROTOCOLS · DEFI SECURITY

Security Intelligence
for Flare DApps

Independent NIST 800-53 security audits of Firelight, Kinetic Market, SparkDex, Spectra Finance, and Mystic Finance on Flare Network, delivered to your inbox every week. Between audits, my monitoring agent checks all five every 15 minutes. Free and premium tiers available.

20 NIST 800-53 controls 5 protocols audited Weekly audits

BEFORE YOU INVEST, WATCH THIS FIRST

New to DeFi on Flare Network?

This 7-minute intro covers SparkDex, Spectra Finance, and Mystic Finance, and why security matters before you invest.

More videos: youtube.com/@DefiSentinelWatch

PUBLICATIONS

Firelight
Firelight stXRP · Flare Network
Weekly NIST 800-53 audit · every Thursday

Firelight is XRP liquid staking on Flare: deposit FXRP, receive stXRP. We audit the stXRP vault (an ERC-4626 vault over FAssets FXRP) against all 20 controls. We check that stXRP is fully backed, how much FXRP the vault holds on-chain, the deposit cap, that withdrawal periods are advancing, who can upgrade the vault, and its FAssets dependency.

Free Premium $14/mo Monitoring $19/mo
Subscribe free How we audit Firelight →
DeFi Sentinel Watch
SparkDex · Flare Network

Weekly NIST 800-53 security audits on SparkDex V3 and V4 liquidity pools. Free subscribers get 5 core controls. Premium gets all 20.

Free Premium $14/mo Monitoring $19/mo
Subscribe free How we audit SparkDex →
Spectra Finance
Spectra · Flare Network

Weekly NIST 800-53 security audits of Spectra Finance yield tokenization pools on Flare Network. We cover the stXRP and sFLR fixed-rate (PT/YT) markets.

Free Premium $14/mo Monitoring $19/mo
Subscribe free How we audit Spectra Finance →
Mystic Finance
Mystic Finance · Flare Network

Weekly NIST 800-53 audits of Mystic Finance lending vaults on Flare Network. Mystic is built on Morpho. We audit the FXRP, wFLR, and USDT0 vaults.

FreePremium $14/moMonitoring $19/mo
Subscribe free How we audit Mystic Finance →
Kinetic Market
Kinetic · Flare Network
Weekly NIST 800-53 audit · every Tuesday

Kinetic is a Compound-fork lending protocol on Flare. We audit 10 markets: the core pool (kFLR, kSFLR, kWETH, kUSDC.e, kUSDT, kUSDT0, kFLRETH) and the FXRP isolated pool (isoFXRP, isoUSDT0, isoSTXRP), against all 20 controls. We check withdrawal liquidity, reserves against borrows, oracle prices and stablecoin pegs, pause state, admin control, and code changes.

Free Premium $14/mo Monitoring $19/mo
Subscribe free How we audit Kinetic Market →

OUR METHODOLOGY

Built on the same framework used by US federal agencies.

We apply NIST SP 800-53 Rev. 5 to DeFi protocols on Flare. The methodology covers all 20 control families, which controls we picked, and how each one maps to an on-chain check.

Read the whitepaper →

THIS WEEK IN DEFI SECURITY

RECENT DEFI EXPLOITS
2026-10-28
ZkLinkNova
zklinknova zklink novas l1 arbitrator authenticates a cross chain claim with a transient finalizemessagehash that claimmessage never clears and never re checks per call and the syncl2txhashrelayer that feeds it is public with no role so an attacker populates a valid transient hash with one relay call then reuses it in a second call that points the claim target at ethereumgatewaysendmessage which runs zklinksyncbatchroot under the gateway identity and installs an attacker chosen l2logsroothash for a batch after which withdrawals finalize against forged proofs that the real on chain verifier accepts
2026-10-27
FenceTranchePool
fencetranchepool a valinor digital tranche pool on avalanche settles each utc day by subtracting a scheduled principal payment from the borrowers outstanding principal with no usdc actually repaid and draw checks the requested amount against funded principal minus outstanding principal so at the day rollover the phantom reduction restores draw capacity that was already spent the borrower side is permissionless so a fresh contract opens a facility naming itself as borrower funds the principal with an aave flash loan and draws it straight back out then one utc day later replays the identical draw calldata to pull the pools own standing liquidity
2026-10-26
SafeApprovalSquat
safeapprovalsquat the safe held standing unlimited erc20 approvals usdc wavax wethe btcb set 2026 03 07 and never revoked to a counterfactual address that was empty on avalanche that address is the 13th create output of a safe createcall instance which is itself the deterministic create2 output of the safe singleton factory salt 0 fixed initcode an erc20 approval is granted to an address not to a specific caller so any fresh eoa can reproduce the same create2 then create math occupy the address and call transferfrom to spend the approvals with no safe key signature or role
2026-10-25
Yapeswap
yapeswap yapeswaps workersunion dao carries a zero quorum minimumvotes and minimumvotesforproposing are both 0 and factoryfeetosetter held by the dao timelock can re point the factorys yearn registry and operator while each yapepair farms its reserves into whatever vault registrylatestvaulttoken returns and credits every token it ships out back to farmingtoken so its keepbalance invariant erc20 balance farming still holds after the real tokens have left so anyone can buy a dust amount of the freely traded yape lock it for sqrt weighted voting power pass a proposal that moves feetosetter to themselves through real voting and the timelock swap in a registry pointing at a vault they own and force a 100 rebalance that ships every pairs reserves straight to the attacker
2026-10-24
X100Senate
x100senate the x100 senate treasury has no snapshot and no timelock so applyforsenate is permissionless and propose vote and execute run in one block so the attacker flash borrows 1942457 usdt from aave buys 38200 x and freezes it across two helper contracts to seize 2 of 3 senate seats then passes a dextreasury v3swap that dumps 400000 treasury x into an attacker created pancakev3 pool at a manipulated price and resells it on the deep uniswap pool repaying the flash loan for a 474972603 usdt net gain
Updated: 2026-11-08 01:00 UTC
THIS WEEK'S AUDIT RESULTS
SparkDex pools
6 pools
audited Nov 8
✓ 4 PASS ◐ 2 PARTIAL
Spectra Finance
2 pools
audited Nov 4
◐ 1 PARTIAL ✕ 1 FAIL
Mystic Finance
3 vaults
audited Nov 5
◐ 3 PARTIAL
Kinetic Market
10 markets
audited Nov 4
✓ 10 PASS
Firelight stXRP
1 vault
audited Nov 5
✓ 1 PASS
Overall rating of each pool, vault or market in the protocol's latest weekly audit

CONTROL OF THE WEEK

CONTROL OF THE WEEK

NEW TO DEFI SECURITY?

01
What is a liquidity pool?

A liquidity pool is a smart contract that holds two tokens and allows people to trade between them. When you provide liquidity, you deposit both tokens and earn a share of the trading fees. It works a bit like being a silent partner in a currency exchange: you supply the capital, traders use it, and you earn a cut of every trade.

The risk: your capital is controlled by smart contract code. If that code has a vulnerability or is poorly governed, your funds could be at risk.

02
Why does security matter before you invest?

Banks and investment funds are regulated and insured. DeFi has no regulator and no FDIC. The only thing between your money and a total loss is the security of the smart contract holding it.

Knowing the security posture of a pool before you invest is the DeFi equivalent of reading a prospectus.

03
How does DeFi Sentinel Watch help?

We apply NIST SP 800-53 (the same security framework US federal agencies use) to five protocols on Flare Network: Firelight's stXRP vault, Kinetic Market's lending markets, SparkDex liquidity pools, Spectra Finance yield pools, and Mystic Finance lending vaults. Every week we run 20 security checks on each and deliver the results to your inbox.

We now also run a weekly NIST 800-53 audit on Kinetic Market lending markets (every Tuesday) and the Firelight stXRP liquid staking vault (every Thursday).

Free subscribers get 5 core checks. Premium subscribers get all 20. Monitoring subscribers get an email within 15 minutes when my agent spots a change on any of the five protocols, and the email says exactly what changed. You do not need a crypto wallet to subscribe, just an email address.

Start with a free subscription →

WHAT THE CONTROLS MEAN FOR YOUR CAPITAL

AC-2
Account Management
Checks who can change or upgrade the protocol and what kind of account that is: a single wallet, a Safe multisig, or a timelock. A single wallet that can act at once is a FAIL, because one stolen key would be enough.
AC-3
Access Enforcement
Checks for recent owner, role, and upgrade changes. On SparkDex it reads the last 100,000 blocks (about 2 days), and any change is rated PARTIAL so it can be checked against SparkDex announcements.
CM-6
Configuration Management
Saves the settings that should not change without notice and compares them at the next audit. On SparkDex that means fee tier, tick spacing, and plugin settings. An unexpected change can alter your returns or point to an unauthorized admin action.
SI-7
Software Integrity
Fingerprints the deployed code and compares it with the last audit. For pools and vaults this is a SHA-256 hash of the code. For upgradeable contracts it is the address of the code the proxy points to. An unannounced change is a red flag.
RA-3
Oracle Integrity
Checks prices and values. SparkDex compares each pool's price with Flare FTSO prices: more than 2% apart is PARTIAL and more than 5% is a FAIL. Mystic and Kinetic check their oracle prices, Spectra checks what a Principal Token redeems for, and Firelight checks that each stXRP is backed by at least 1 FXRP.
CP-9
State Recovery
For SparkDex, Spectra, and Mystic, checks whether you get time to exit before an admin or upgrade change takes effect. A timelock or delay of at least 24 hours is needed for a PASS. For Kinetic it measures reserves against borrows, and for Firelight how much of what stakers are owed the vault holds on-chain.
AC-6
Least Privilege
Checks how admin power is split. On SparkDex V4 pools a single-wallet pool administrator is a FAIL, because that key can install a new plugin. On V3 pools it looks for admin functions in the pool code beyond fee settings.
AU-2
Audit Events
Checks that activity is logged on-chain. On SparkDex it reads every event the pool emitted in the last 96,000 blocks (about 2 days), and no events at all is PARTIAL. Scored together with AU-6.
AU-6
Audit Review
Checks that someone reviews the logs. Every weekly audit reviews recent events. My monitoring agent also checks all five protocols every 15 minutes.
SC-5
DoS Protection
Checks liquidity depth. On SparkDex, at least $25,000 in the pool with liquidity active at the current price is a PASS. In a thinner pool, a small trade can move the price a long way.
SC-8
Transmission Integrity
On SparkDex, checks that the documented factory lists this contract as the pool for its token pair, so swaps sent through the router reach it. This covers the contracts only, not a website or app front end.
SI-2
Flaw Remediation
On SparkDex, checks that the pool came from the current documented V3.1 or V4 factory, has a price set, and does not have its reentrancy lock stuck on. A pool from another factory may be missing fixes.
IR-4
Incident Handling
On SparkDex, checks whether the pool can be halted in an emergency: the pool's status in SparkDex's security registry for V4, and a pause function for V3. A V3 pool with no emergency stop is PARTIAL.
SA-11
Security Testing
Lists the published audits and bug bounties for the code each engine checks, with links, and rates how closely they cover the contracts deployed on Flare. We read the published listings. We do not re-audit the code.
SI-4
System Monitoring
Watches for activity that stops or spikes. SparkDex and Spectra compare the last day's pool events with the day before and flag a pool that goes quiet or jumps to more than 3 times its usual activity. Mystic, Kinetic, and Firelight watch withdrawals or borrow rates.
IR-5
Incident Monitoring
Counts admin and incident events (pause, upgrade, ownership, role, and setting changes) and keeps a running total across audits. A pool with repeated incidents carries more risk than one with a clean record.
IA-3
Device Authentication
Checks the identity of the contracts a pool or vault relies on. On SparkDex both pool tokens must be the official contracts, and a pool holding a different token from the one in its name is a FAIL.
SC-7
Boundary Protection
Compares the contracts a pool, vault, or market depends on (factories, tokens, plugins, adapters, rate models) with published addresses or the addresses seen at the last audit. A mismatch is a FAIL. A dependency that cannot be verified is PARTIAL.
RA-5
Vulnerability Scanning
Looks for on-chain signs of a dangerous power or a realized loss. It does not scan for code bugs. SparkDex searches the pool code for functions that could move funds or replace the code. The other engines check that a share or token has not lost value.

WHAT YOU GET

Feature
Free
Premium$14/moFounder $9
Monitoring$19/mo
Weekly audit reports
✓
✓
✓
5 core NIST 800-53 controls
✓
✓
✓
All 20 NIST 800-53 controls
✗
✓
✓
Report archive access
✗
✓
✓
15-minute monitoring (all five protocols)
✗
✗
✓
Email alerts when a change is detected
✗
✗
✓
Bytecode change detection
✗
✗
✓
Code and config change alerts
✗
✗
✓

Founder pricing for the first 100 subscribers: Premium for $9/mo ($84/yr) instead of $14/mo ($120/yr), kept for as long as you stay subscribed. Monitoring is $19/mo ($164/yr).

ABOUT THE ASSESSOR

Brandon J. Johnson
Retired Federal Government Employee · US Army Veteran · Security Control Assessor · Founder, DeFi Sentinel Watch

As a retired Federal Government Employee, US Army veteran, and career Security Control Assessor, I have spent years evaluating enterprise risks and building compliance roadmaps. When I transitioned into managing my own decentralized finance portfolios on the Flare Network, I noticed a massive security gap. Traditional IT infrastructure relies on continuous monitoring, yet DeFi users often trust their capital to liquidity pools that were only audited once before launch.

DeFi Sentinel Watch was built to bridge that gap. By mapping proven NIST 800-53 security controls directly to on-chain environments like SparkDex, Spectra Finance, and Mystic Finance on Flare Network, we provide the continuous, real-time oversight required for users to confidently monitor the security of their DeFi investments.

Federal Government Employee US Army Veteran Security Control Assessor NIST 800-53 Practitioner Flare Network LP

HOW IT WORKS

01
Automated audits

Our engine runs 20 NIST 800-53 security controls against SparkDex liquidity pools, Spectra Finance yield pools, Mystic Finance lending vaults, Kinetic Market lending markets (every Tuesday), and the Firelight stXRP vault (every Thursday) on Flare Network every week.

02
Reports delivered

Audit reports are generated as PDF and Excel files and delivered to your secure subscriber portal, organized by pool and date.

03
15-minute monitoring

Monitoring subscribers get an email when the agent finds a change on any of the five protocols, such as a contract upgrade, an owner or admin change, a pause, or a 20% drop in the money held. The email says exactly what changed.

We do not store your personal data or subscription information. Access is verified in real time through Beehiiv. This is security intelligence only, not financial or investment advice. Scan reports are kept in your account so you can view them later under My scans, and are never sold or shared.