Tezoro audit
Audit · firm’s term: security audit
Oak Security reviewed Tezoro (Tezoro audit) on 15 May 2026: 23 findings, 0 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings23
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 5 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 0 | 18 |
HighremoveStrategy clears live strategy accounting and understates assetsFixed
The report gives no description here.
HighStale trackedBalance misprices deposits and redemptions between reconcile callsFixed
The report gives no description here.
HighUnderdelivering strategy exits can block normal withdrawalsFixed
The report gives no description here.
HighUnswept base-asset rewards let new depositors capture prior yieldFixed
The report gives no description here.
HighWithdrawals can erase stale balances and reopen cheap entryFixed
The report gives no description here.
LowAave emergency withdrawal reverts and misclassifies recoverable funds as lostFixed
The report gives no description here.
LowEarly withdrawals can shift exit losses onto later usersFixed
The report gives no description here.
LowFee hikes can overcharge old unreconciled yieldFixed
The report gives no description here.
LowFull-share FluidStrategy emergency redemption misclassifies recoverable funds as lostFixed
The report gives no description here.
LowMissing baseToken validation strands CompoundV3Strategy funds in collateral modeFixed
The report gives no description here.
Show 10 more
LowMissing timelock expiry window enabling stale proposal executionFixed
The report gives no description here.
LowOpaque claim and swap calldata can redirect rewardsFixed
The report gives no description here.
LowPause-insensitive liquidity estimates overstate ERC-4626 withdrawal limitsFixed
The report gives no description here.
LowPaused strategies keep allowance and can still pullFixed
The report gives no description here.
LowRecalled strategies keep approval and may pull vault assetsFixed
The report gives no description here.
LowRedeem fallback underquotes shares and leaves sub-vault liquidity unreachableFixed
The report gives no description here.
LowremoveStrategy can orphan paused Aave positions and underprice sharesFixed
The report gives no description here.
LowReverting sub-vault views distort vault NAV and make healthy liquidity unreachableFixed
The report gives no description here.
LowRewards module rotation can trap base assetFixed
The report gives no description here.
LowStale yield can let deposits bypass the capFixed
The report gives no description here.
Show 3 more
LowTiny interactions can raise highWaterMark without feesFixed
The report gives no description here.
LowUnhealthy strategies can keep funds after de-riskingFixed
The report gives no description here.
LowUnrevoked sub-vault allowances allow frozen children to pull idle strategy assetsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Tezoro’s security record
TezoroSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us