Ensuro Strategy Vault

QuantstampRepository at commit bc7bfa8

Quantstamp reviewed Ensuro Strategy Vault on 17 Mar 2025: 7 findings, 0 critical; 4 marked fixed, 3 acknowledged.

No open critical findings
Open the reportOpen Ensuro Strategy Vault’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low034
LowChanging Slot Size Temporarily Allows Excessive OutflowAcknowledged

In the `OutflowLimitedAMMSV` contract, the `slotsize` is used as part of the key to track outflow data. Changing the `slotsize` shifts the upper bits of the key, effectively using a new "namespace" where old data is kept separate and not included in future checks. For the duration of the next `slotsize`, the `SlotIndex prevSlot = SlotIndex.wrap(SlotIndex.unwrap(slot) - 1);` will point to empty data and not contribute to the delta calculation. This resets the outflow history without deleting past records.

LowHard-Coded `_price` Can Become Stale and Inaccurate in the Event of a DepegAcknowledged

The `SwapStableInvestStrategy` holds a fixed `_price` for the exchange rate between `_asset` and `_investAsset`. While this is sufficient for closely pegged assets, it becomes a risk if the peg is lost (e.g., stablecoin depegs) or if `_price` remains hard-coded despite market shifts. Users may then encounter large slippage, receive fewer tokens, or lose slippage protection if `_price` no longer matches real conditions. In extreme cases, it may become impossible to withdraw at the assumed `_price` unless `maxSlippage` is raised significantly.

LowPotential Double Counting in `totalAssets()` if Multiple Strategies Share the Same Underlying AssetAcknowledged

In the current design, each strategy’s `totalAssets()` reflects that strategy’s own asset (e.g. `aToken` and `cToken` and `asset`) holdings. Since the strategies do not overlap in the assets they hold, the vault’s global `totalAssets()` remains accurate. However, if a future strategy reuses the same underlying asset as another existing strategy, the vault could mistakenly double-count those holdings when summing across all strategies.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (11)

  • https://github.com/ensuro/vaults/contracts/OutflowLimitedAMMSV.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3
  • https://github.com/ensuro/vaults/contracts/AccessManagedMSV.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3
  • https://github.com/ensuro/vaults/contracts/interfaces/IInvestStrategy.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3
  • https://github.com/ensuro/vaults/contracts/SwapStableAaveV3InvestStrategy.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3
  • https://github.com/ensuro/vaults/contracts/InvestStrategyClient.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3
  • https://github.com/ensuro/vaults/contracts/SwapStableInvestStrategy.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3
  • https://github.com/ensuro/vaults/contracts/AaveV3InvestStrategy.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3
  • https://github.com/ensuro/vaults/contracts/AccessManagedProxy.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3
  • https://github.com/ensuro/vaults/contracts/CompoundV3InvestStrategy.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3
  • https://github.com/ensuro/vaults/contracts/MSVBase.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3
  • https://github.com/ensuro/vaults/contracts/interfaces/IExposeStorage.sol at commit bc7bfa872901f90d6e3e2034e5bb82e9b7918ad3

Part of Ensuro Strategy Vault’s security record

Ensuro Strategy Vault
Audits1 audit by 1 firmLast audit Mar 2025, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open Ensuro Strategy Vault’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us