Syntetika Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Syntetika (Syntetika Audit Report) on 1 Aug 2025: 9 findings, 0 critical; 8 marked fixed, 1 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 1 | 6 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalComplianceChecker::isCompliant incorrectly returns true if compliance options have no required soul bound tokensAcknowledged
The report gives no description here.
InformationalConsider using a staking rewards distributor to efficiently space out staking rewards, further deterring just-in-time attacksAcknowledged
The report gives no description here.
InformationalMinter::ownerMint bypasses whitelist requirement and increases totalDeposits without actually transferring any tokensAcknowledged
The report gives no description here.
InformationalNot check for timestamp in distributeYield could DoS the distribute rewardsAcknowledged
The report gives no description here.
GasSmall functions only used once should be inlined into their parent functionsAcknowledged
The report gives no description here.
GasCache storage to prevent identical storage readsFixed
The report gives no description here.
InformationalConsider using SafeCast when downcasting amountsFixed
The report gives no description here.
InformationalDon’t initialize to default values in SolidityFixed
The report gives no description here.
InformationalEmit missing event informationFixed
The report gives no description here.
InformationalEnforce minimum transaction amounts in StakingVaultFixed
The report gives no description here.
Show 10 more
InformationalEnforce that StakingVault::decimals is greater or equal to the underlying asset decimalsFixed
The report gives no description here.
InformationalMissing call to _setGlobalWhitelist in Minter.solFixed
The report gives no description here.
InformationalMissing redeem convenience function in the StakingVault.solFixed
The report gives no description here.
InformationalPrefer explicit uint sizesFixed
The report gives no description here.
GasRemove from parameter from Minter:redeem and _onlySender functionFixed
The report gives no description here.
InformationalRemove obsolete return statements when using named return variablesFixed
The report gives no description here.
InformationalRevert if StakingVault::deposit, mint, redeem, withdraw would return zeroFixed
The report gives no description here.
InformationalRoles not set in deposit-registry contract constructorsFixed
The report gives no description here.
InformationalStakingVault::claimWithdraw should revert if assets are zeroFixed
The report gives no description here.
InformationalStakingVault::distributeYield should revert when there are no vault sharesFixed
The report gives no description here.
Show 5 more
InformationalUse named importsFixed
The report gives no description here.
InformationalUse named mapping parameters to explicitly note the purpose of keys and valuesFixed
The report gives no description here.
GasUse named return variables when this eliminates local variablesFixed
The report gives no description here.
GasUse ReentrancyGuardTransient for faster nonReentrant modifiersFixed
The report gives no description here.
GasVariables only set once in constructor of non-upgradeable contracts should be declared immutableFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Syntetika’s security record
SyntetikaSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us