vesu protocol security review

Cairo Security Clan12 Mar 2025Files named in the report

Audit · firm’s term: security review

Cairo Security Clan reviewed Vesu (vesu protocol security review) on 12 Mar 2025: 2 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Vesu’s security record

Report stored on IPFS. Content hash bafybeif5mbamq3yqk7esqekbway2jrawasktz7itx6qv7bmx24yggkfbdy

Trustblock does not review code.

Findings2

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	1
Medium	0	0	0
Low	0	0	1

Highfixed shutdown mode is bypassed in function shutdown_statusFixed

The fixed shutdown mode, which is set by the pool owner, is intended to take precedence over the shutdown mode inferred from the system. However, the shutdown_status function checks the inferred mode first and returns immediately if a valid mode is found, bypassing the fixed shutdown mode that should override it. Recommendation: Consider checking the fixed shutdown mode first and returning if the result is not normal mode.

Lowoverwrite shutdown mode not implemented in ekubo oracle extensionFixed

The latest update to the vesu protocol introduces the ability to manually overwrite the shutdown mode across all existing default extensions. However, the ekubo oracle extension does not include this functionality, creating inconsistency with other extensions. Recommendation: Implement the ability to overwrite the shutdown mode in the ekubo oracle extension to maintain consistency.