Strata Tranches Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Strata (Strata Tranches Audit Report) on 8 Oct 2025: 14 findings, 1 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings14
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 6 |
| Low | 0 | 0 | 5 |
CriticalWithdrawers of sUSDe always incur a loss because parameters passed from Tranche::_withdraw to CDO::withdraw are invertedFixed
The report gives no description here.
HighMechanism to prevent donation attack can be gamed to cause withdrawals to revert causing assets to get stuck on the StrategyFixed
The report gives no description here.
HighUsers can get their withdrawal active requests DoSed by malicious usersFixed
The report gives no description here.
MediumNAVs or APRs are updated using an outdated accounting on certain operationsFixed
The report gives no description here.
MediumProxy reuse without implementation check inside UnstakeCooldown leads to execution on outdated/vulnerable logicFixed
The report gives no description here.
MediumReducing reserves requesting USDe as the asset to receive causes the Strategy to release more sUSDe than necessaryFixed
The report gives no description here.
MediumTranche::maxMint for Junior Tranches is at risk of overflow when the jrNav falls below 1:1 rate to JR_SharesFixed
The report gives no description here.
MediumTranche::redeem calls super.withdraw instead of super.redeem causing users to receive fewer assetsFixed
The report gives no description here.
MediumWhen Senior’s TargetGain is negative, the tx will revert because the senior loss is not accounted for on the Junior Tranche as profit, causing the navs summation to not match the current navFixed
The report gives no description here.
LowAccounting::setMinimumJrtSrtRatio sets reserveBps instead of minimumJrtSrtRatio making ratio configuration impossibleFixed
The report gives no description here.
Show 4 more
LowDEFAULT_ADMIN_ROLE can be mistakenly granted to an account when granting permission to call fallback on any contractFixed
The report gives no description here.
LowFrontrunning to Block Junior Tranche WithdrawalsFixed
The report gives no description here.
LowInconsistent APR boundary validation between AprPairFeed and AccountingFixed
The report gives no description here.
LowInconsistent Risk Premium Validation in Accounting Allows Future Underflows or Zero APRFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Strata’s security record
StrataSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us