Securitize Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Securitize (Securitize Audit Report) on 18 Jul 2024: 15 findings, 2 critical; 14 marked fixed, 1 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings15
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 3 |
| Medium | 0 | 1 | 3 |
| Low | 0 | 0 | 6 |
CriticalMissing validation on the msg.sender in SecuritizeSwap::buy functionFixed
The report gives no description here.
CriticalWrong decimals in the calculation of liquidity amount during redemptionFixed
The report gives no description here.
HighMissing access control in CollateralLiquidityProvider::setCollateralProviderFixed
The report gives no description here.
HighMissing access control in CollateralLiquidityProvider::setExternalCollateralRedemptionFixed
The report gives no description here.
HighWrong validation on the availableLiquidity in function SecuritizeRedemption::redeem()Fixed
The report gives no description here.
MediumMissing validation of msg.value in the function SecuritizeSwap::executePreApprovedTransaction()Fixed
The report gives no description here.
MediumNo storage gap for upgradeable contract might lead to storage slot collisionFixed
The report gives no description here.
MediumNo validation check of _investorWallet when buying dsToken.Fixed
The report gives no description here.
LowBad practice to have multiple initializersFixed
The report gives no description here.
LowMissing input validation in CollateralLiquidityProvider::setExternalCollateralRedemptionFixed
The report gives no description here.
Show 4 more
LowMissing slippage control for investors during the buyFixed
The report gives no description here.
LowMissing zero check for the result of ecrecover()Fixed
The report gives no description here.
LowPrecision loss in the SecuritizeSwap.calculateDsTokenAmount() function.Fixed
The report gives no description here.
LowThe SecuritizeRedemption.updateLiquidityProvider function emits the wrong information.Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Securitize’s security record
SecuritizeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us