lucas-manuel

SparkLend Rounding Release — Security Notes

Design summary, known issues, and deployment constraints for the SparkLend rounding release. Prepared by Phoenix Labs as supplemental material for the release and its external audit. Version of 2026-09-02.

Scope

• Repository: sparkdotfi/sparklend-v1-core
• Release candidate: branch dev, commit 900c189f
• Diff base: tag v1.0.0, commit 8120e495 (the code deployed behind the live proxies)

lucas-manuel

Onboarding the Diamond PAU Controller alongside the existing ALM Controller

Proposal

Spark proposes onboarding the Diamond PAU Controller on Ethereum mainnet in parallel with the existing MainnetController. Both controllers operate the same ALMProxy. The new controller receives its own dedicated RateLimits instance and is wired with exactly three integrations: UNISWAP_V4_FACET (swaps and LPing), CCTP_FACET (CCTP v2 transfers), and DUAL_POOL_FACET (LPing through the DualPoolHook).

1. No funds are migrated. The custody contract keeps its bytecode, storage, approvals, and positions.
2. The legacy MainnetController is completely untouched, so the upgrade is fully backwards compatible.
3. The new controller can execute exactly seven value-moving operations — swap, mintPosition, increasePosition, decreasePosition (UniV4), transfer (CCTP), deposit, withdraw (DualPool). Every other call reverts.
4. The new controller's rate limits are a separate instance, so it is i

lucas-manuel

Prime Agent Spells Reviewer Checklist

Spell: feat/sc-1573-spell-20260716 Reviewed at commit: 32d0504c18115873369eaf1028abc0ce90a9df3f Stage: Review Stage

---

Development Stage

lucas-manuel

Prime Agent Spells Reviewer Checklist

Spell: feat: Spell 2026-07-02 (SC-1557) Reviewed at commit: f4f79f45934fa0626aa984c3ed564d908876d982 Stage: Review Stage

---

Development Stage

lucas-manuel

coverage_report:
    name: Generate coverage report
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v2
    
    - name: Install Foundry
      uses: onbjerg/foundry-toolchain@v1
      with:
        version: nightly

lucas-manuel

Top of File

All files should have a license and pragma defined in the top two lines of the file:

// SPDX-License-Identifier: AGPL-3.0-or-later
pragma solidity 0.6.11;

Contract Imports

1. All imports must be explicit, importing only what is necessary from each file.

lucas-manuel

// SPDX-License-Identifier: AGPL-3.0-or-later
pragma solidity 0.8.7;

/// @title Interface of the ERC20 standard as defined in the EIP, including EIP-2612 permit functionality.
interface IERC20 {

    /**************/
    /*** Events ***/
    /**************/

lucas-manuel

git clean -xfd
git submodule foreach --recursive git clean -xfd
git reset --hard
git submodule foreach --recursive git reset --hard
git submodule update --init --recursive

lucas-manuel

Install hevm

Had to do a brew install cabal-install in order to get the cabal install --lib command to work

Had to do a brew install libtool for ./autogen.sh in secp256k1

Need to do brew install openssl

Had to add

lucas-manuel

// SPDX-License-Identifier: AGPL-3.0-or-later
pragma solidity ^0.8.7;

import { IMapleProxyFactory } from "../modules/maple-proxy-factory/contracts/interfaces/IMapleProxyFactory.sol";

import { IMapleBorrower } from "./interfaces/IMapleBorrower.sol";

import { MapleBorrowerInternals } from "./MapleBorrowerInternals.sol";

/// @title MapleBorrower facilitates atomic and batch borrower functionality for MapleLoans.