Illuvium Staking V3 Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Illuvium (Illuvium Staking V3 Audit Report) on 21 Oct 2025: 7 findings, 0 critical; 6 marked fixed, 1 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings7
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 1 | 6 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalConsider adding a minimum deposit amount in StakingVaultFixed
The report gives no description here.
InformationalInconsistent recipient handling for claimable poolsFixed
The report gives no description here.
InformationalLack of events emitted for important state changesFixed
The report gives no description here.
InformationalLack of validation of Pool.underlyingToken == Staking- Vault.stakingAssetFixed
The report gives no description here.
InformationalMissing address(0) check in setDistributorFixed
The report gives no description here.
InformationalMissing sanity check for reasonable duration valuesFixed
The report gives no description here.
InformationalRedundant recomputation of accrued rewards in StakingVault::_updateRewardsFixed
The report gives no description here.
GasUnoptimised overflow check in _assertFixedBpsCapFixed
The report gives no description here.
InformationalUnused factory storage in L2RevenueDistributorV3Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Illuvium’s security record
IlluviumSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us