We recently completed a second independent security audit of the Homelander Algebra plugin, conducted by Bailsec. This audit was structured as a differential review, covering the changes introduced in the updated contract relative to the previously audited version. This post summarizes the scope of the review, what the audit found, and what the results confirm about the updated implementation.
Audit Scope and Methodology
The differential audit covered the set of changes introduced since the first Bailsec review of the Homelander Algebra plugin. The scope was bounded to the diff between the two contract versions and did not re-examine logic that remained unchanged. The assessment was conducted through manual code review focused on the correctness and safety of the new and modified logic within the Algebra Integral execution environment.
The reviewed changes included the addition of a pre-swap hook responsible for dynamic fee configuration, gas-related safety measures, refactoring of the post-swap control flow, and a new endpoint handling Algebra’s batched plugin fee settlement.
During the review, the auditors analyzed the full execution paths introduced by these changes: how the pre-swap hook determines and returns fee values to Algebra depending on caller identity and MEV protection configuration, how the refactored post-swap logic routes into the arbitrage execution path, and how the fee settlement endpoint receives and forwards Algebra’s delayed fee transfers to the profit distributor.
The review also examined privilege boundaries across the owner-controlled configuration functions, the core invariants governing fee behavior across the defined caller categories, and failure and revert conditions across all modified control flows.
High-Level Audit Results
The audit did not identify any high severity vulnerabilities in the reviewed changes. Bailsec identified two medium severity issues, both of which were resolved before the final report was issued. The findings related to profit distribution semantics in multi-hop swap routing and a missing view function required by Algebra’s dynamic fee interface. None of the identified issues introduced exploitable paths affecting core protocol logic, user swap correctness, pool funds, or LP positions.
In particular, the audit confirms the following properties of the updated implementation:
- The beforeSwap hook supplies fee override and plugin fee values to Algebra within defined per-component bounds and does not introduce execution paths that would allow fee manipulation outside of configured parameters;
- The afterSwap hook retains the isolation properties confirmed in the prior audit: failures in the external MEV execution stack are absorbed within the hook and do not propagate into the user’s transaction or alter the swap outcome;
- The handlePluginFee endpoint correctly receives and forwards Algebra’s delayed plugin fee transfers to the profit distributor and operates within expected behavior under normal conditions;
- Profit distribution does not depend on swap-level recipient data that is unreliable in multi-hop routing contexts.
Taken together, these results indicate that the updated Algebra plugin implementation extends the previously audited execution model without introducing new classes of exploitable risk. The resolved medium severity findings address interface correctness and distribution semantics, and their resolution was confirmed through re-review prior to the final report.
Execution-Level Safety Properties
The updated implementation extends the plugin’s execution surface relative to the first audited version, adding a pre-swap phase and a fee settlement endpoint alongside the post-swap MEV capture logic reviewed previously. Neither addition changes the fundamental isolation properties of the execution model.
The pre-swap phase is limited to fee configuration. The plugin evaluates caller identity and the current MEV protection state, returns the appropriate fee values to Algebra, and exits. It does not hold funds, does not modify pool state, and has no influence over swap execution beyond the fee parameters it supplies. Swap accounting and all asset transfers remain entirely governed by the AMM.
The fee settlement endpoint handles amounts that Algebra has already accrued and transferred through its own internal mechanism. The plugin does not initiate these transfers and does not control their timing or magnitude. Its role at settlement is to receive and forward, with distribution logic invoked after the transfer is complete.
The post-swap MEV execution model is unchanged from the prior implementation. Arbitrage logic runs after the AMM has finalized its state transition, within the same transaction boundary, and does not affect swap correctness or pool balances regardless of whether MEV capture completes. Failures in the external execution stack remain absorbed within the hook and do not reach the user’s transaction.
Taken together, the reviewed changes extend the plugin’s configuration and settlement capabilities without expanding the attack surface of its core execution model. The boundaries between fee configuration, MEV capture, and AMM swap execution remain clearly defined and independently enforced.
For this review we worked with the Bailsec team, whose familiarity with the codebase from the first engagement allowed for a focused and substantive differential review. The process was thorough and iterative, with resolved findings re-examined before the final report was issued. This is our second audit with them, and we appreciate the continued collaboration! The full audit report is available here.
For a deeper look at Homelander’s mechanics, check the documentation and our earlier publications (I/II/III). If you’d like to explore an integration or partnership, you can reach us on Telegram.
