Syntetika Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Syntetika (Syntetika Audit Report) on 1 Aug 2025: 9 findings, 0 critical; 8 marked fixed, 1 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 1 | 6 |
HighMinter doesn’t account for depegs, exchange rates and decimal precision mismatch between baseAsset and hilBTCToken, which can result in total loss scenarios for both users and protocolFixed
The report gives no description here.
MediumYield tokens can be permanently locked in the vault when all stakers withdraw during vesting windowFixed
The report gives no description here.
LowBlacklisted users can claim withdrawn assets after the cooldown periodFixed
The report gives no description here.
LowInability for users to permissionlessly stake and earn yieldFixed
The report gives no description here.
LowMissing check if receiver is whitelisted in StakingVault::mint, depositFixed
The report gives no description here.
LowNon-compliant users can claim withdrawn assets after the cooldown periodFixed
The report gives no description here.
LowOwner can not burn tokens from blacklisted addressesFixed
The report gives no description here.
LowUnbounded depositAddresses can cause CompliantDepositRegistry::challengeLatestBatch to revert due to out of gasFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Syntetika’s security record
SyntetikaSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us