Securitize Public Stock On/Off Ramp Audit Report
Cyfrin reviewed Securitize (Securitize Public Stock On/Off Ramp Audit Report) on 24 Dec 2025: 18 findings, 0 critical; 15 marked fixed, 3 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings18
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 4 |
| Low | 0 | 3 | 11 |
Marked Gas or Informational by the firm. Not counted as findings.
GasCache computation where it is performed multiple timesAcknowledged
The report gives no description here.
GasCache decimals of underlying asset at initialization in SecuritizeAmm- NavProviderAcknowledged
The report gives no description here.
GasCache required storage slots in top-level functions then pass cached values to child functionsAcknowledged
The report gives no description here.
InformationalConsider enforcing minimum redemption amounts in PublicStockOffRamp, SecuritizeOffRamp::redeemAcknowledged
The report gives no description here.
GasFee calculation occurs twiceAcknowledged
The report gives no description here.
InformationalMbpsFeeManager::setFeePercentageMBPS allows setting fee greater than maxAcknowledged
The report gives no description here.
InformationalNot way to change the recipient in the liquidity provider in the offramp logicAcknowledged
The report gives no description here.
InformationalRefactor identical code from SecuritizeAmmNavProvider::_pricingFromCurveBuy, _pricingFromCurveSell into internal functionAcknowledged
The report gives no description here.
GasRefactor PublicStockOnRamp::initializedNavProvider, BaseOffRamp::nonZeroLiquidityProvider into internal functions to prevent identical storage readsAcknowledged
The report gives no description here.
InformationalSingle step redemption and two step redemption not equivalent logicAcknowledged
The report gives no description here.
Show 10 more
InformationalUnused nonce Field in ExecutePreApprovedTransaction structAcknowledged
The report gives no description here.
GasUse of modifier nonZeroNavRate in SecuritizeOnRamp and SecuritizeOffRamp results in duplicate external call with identical resultAcknowledged
The report gives no description here.
GasBetter storage packing by changing declaration orderFixed
The report gives no description here.
GasCache storage to prevent identical storage readsFixed
The report gives no description here.
GasEmit events first to refactor away local variables storing previous valuesFixed
The report gives no description here.
GasIn Solidity don’t initialize to default valuesFixed
The report gives no description here.
InformationalMissing liquidityToken validation in CollateralLiquidityProvider::initializeFixed
The report gives no description here.
InformationalRedundant Access Control Check in SecuritizeInternal- NavProvider::addRateUpdater, removeRateUpdaterFixed
The report gives no description here.
GasRefactor away unnecessary local variables in SecuritizeAmm- NavProvider::_curveBuy, _curveSellFixed
The report gives no description here.
InformationalUse named mapping parameters to explicitly denote the purpose of keys and valuesFixed
The report gives no description here.
Show 3 more
GasUse named return variables where this can refactor away local variablesFixed
The report gives no description here.
InformationalUse SafeERC20 approval and transfer functions instead of standard IERC20 functions for liquidityTokenFixed
The report gives no description here.
GasWhen emitting events don’t read known values from storageFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Securitize’s security record
SecuritizeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us