Venus - WUSDMLiquidator

CertiKRepository at commit 0c7461c

Audit

Part of CertiK’s series

CertiK reviewed Venus Protocol (Venus - WUSDMLiquidator) on 29 Apr 2025: 3 findings, 0 critical; all marked fixed.

No open critical findings
Open the reportOpen Venus Protocol’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings3

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low003
Low`_configureMarkets()` side effectsFixed

The `run()` function emits multiple events in the context of the Comptroller and different VTokens on every execution. Since `run()` is unprotected and can be invoked repeatedly, this behavior may lead to unexpected and potentially disruptive events. Furthermore, the function presumes that the `VWUSDM` market is paused for `Action.MINT` and `Action.ENTER_MARKET`, and maintains the paused state after execution. This may be unintended if the market gets unpaused in the future.

Low`closeFactorMantissa` is set via Comptroller upgrFixed

```sol=109 uint256 internal constant MAX_CLOSE_FACTOR_MANTISSA = 1e18; // 1.0, temporarily ``` `WUSDMLiquidator` assumes the Comptroller code will be upgraded, allowing `closeFactorMantissa` to be set higher than the regular 0.9e18. It is unclear when and if the `MAX_CLOSE_FACTOR_MANTISSA` will be restored. ```sol=124 COMPTROLLER.setCloseFactor(1e18); ``` `WUSDMLiquidator` uses the 1e18 value directly as a close factor. It's reasonable to use `COMPTROLLER.MAX_CLOSE_FACTOR_MANTISSA()` instead to ensure the call will always be successful. Or `MANTISSA_ONE` constant in case it is supposed to revert in case of unexpected COMPTROLLER behavior.

Low`run()` is unprotectedFixed

Despite the [description](https://community.venus.io/t/proposal-partial-liquidity-restoration-for-wusdm-on-venus-zksync/5013) stating that the WUSDMLiquidator is meant to be executed solely by Governance, the `run()` function is unprotected and can be called multiple times by any user.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (2)

  • https://github.com/VenusProtocol/isolated-pools/contracts/WUSDMLiquidator.sol at commit 0c7461c10194159d86476812c75eafcec4bf1774
  • https://github.com/VenusProtocol/isolated-pools/contracts/ComptrollerStorage.sol at commit 0c7461c10194159d86476812c75eafcec4bf1774

Part of Venus Protocol’s security record

Venus Protocol
Audits67 audits by 7 firmsLast audit Sep 2025, by Quantstamp.
Critical findingsNo open critical findingsAcross the 67 reports, 4 critical findings were reported. Each is marked fixed by the firm that reported it.
IncidentIncident 12 May 2022Source: De.Fi incident database.
Open Venus Protocol’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us