Quantstamp reviewed Ensuro Strategy Vault on 17 Mar 2025: 7 findings, 0 critical; 4 marked fixed, 3 acknowledged.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 3 | 4 |
In the `OutflowLimitedAMMSV` contract, the `slotsize` is used as part of the key to track outflow data. Changing the `slotsize` shifts the upper bits of the key, effectively using a new "namespace" where old data is kept separate and not included in future checks. For the duration of the next `slotsize`, the `SlotIndex prevSlot = SlotIndex.wrap(SlotIndex.unwrap(slot) - 1);` will point to empty data and not contribute to the delta calculation. This resets the outflow history without deleting past records.
The `SwapStableInvestStrategy` holds a fixed `_price` for the exchange rate between `_asset` and `_investAsset`. While this is sufficient for closely pegged assets, it becomes a risk if the peg is lost (e.g., stablecoin depegs) or if `_price` remains hard-coded despite market shifts. Users may then encounter large slippage, receive fewer tokens, or lose slippage protection if `_price` no longer matches real conditions. In extreme cases, it may become impossible to withdraw at the assumed `_price` unless `maxSlippage` is raised significantly.
In the current design, each strategy’s `totalAssets()` reflects that strategy’s own asset (e.g. `aToken` and `cToken` and `asset`) holdings. Since the strategies do not overlap in the assets they hold, the vault’s global `totalAssets()` remains accurate. However, if a future strategy reuses the same underlying asset as another existing strategy, the vault could mistakenly double-count those holdings when summing across all strategies.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (11)
236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us