TAC Yieldfi proxy

Quantstamp13 Oct 2025Code version: not recorded (see the report)

Audit

Quantstamp reviewed TAC (TAC Yieldfi proxy) on 13 Oct 2025: 2 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open TAC’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings2

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	0
Low	0	0	1

HighStrict Balance Equality Check Can Cause DoSFixed

In the `deposit()` function, the proxy contract checks that the current balance of the actionable token is exactly equal to the supplied parameter. This is likely intended to ensure that no additional tokens have been transferred via the bridge. Instead, this can be exploited to initiate a Denial of Service attack on the deposit action by inflating the proxy contract balance, for example by passing tokens along when calling `claimAsset()` or by transferring dust amounts of tokens from within the EVM. ```solidity require( IERC20(depositArguments.asset).balanceOf(address(this)) == depositArguments.amount, InvalidAmount() ); SafeERC20.safeTransfer( IERC20(depositArguments.asset), user, depositArguments.amount ); ```

LowThe `deposit()` Function Should Not Accept Native TokensFixed

The `deposit()` function is specified as `payable` and thus able to receive bridged native tokens, despite not requiring nor handling native tokens. Removing this functionality may avoid user mistakes.