TAC- Zerolend Proxy Re-Audit

QuantstampFiles named in the report

Audit · firm’s term: re-audit

Quantstamp reviewed TAC (TAC- Zerolend Proxy Re-Audit) on 9 Sep 2025: 1 finding, 0 critical; it is acknowledged, not fixed.

No open critical findings
Open the reportOpen TAC’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings1

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium010
Low000
MediumLack of Excess Token HandlingAcknowledged

The proxy contract does not handle any scenario where more tokens are sent via the `CrossChainLayer` than are actually consumed in the `supply()` or `repay()` functions by the Zerolend protocol. In this scenario, the tokens remain trapped in the proxy contract vault rather than being returned to the `CrossChainLayer` contract and bridged back to their original owner. The situation can be especially tricky in the case of `repay()` as the interest can accrue over time.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (73)

  • contracts/proxies/TacVault/TacBoringVaultProxy.sol
  • contracts/test/MockBluePrint.sol
  • contracts/proxies/Izumi/Interface/ILimitOrderManager.sol
  • contracts/proxies/CurveLite/ICurveLiteTwocryptoFactory.sol
  • contracts/test/MockZerolandPool.sol
  • contracts/proxies/Yield/Constants.sol
  • contracts/proxies/Yield/IManager.sol
  • contracts/test/TestNFTProxy.sol
  • contracts/proxies/UniswapV2/CompilerVersionAdapters.sol
  • contracts/proxies/CurveLite/CurveLiteRouterProxy.sol
  • contracts/proxies/Morpho/Interface/IMetaMorphoV1_1Factory.sol
  • contracts/test/TestProxy.sol
  • contracts/proxies/Merkl/MerklProxy.sol
  • contracts/proxies/Morpho/lib/MathRayLib.sol
  • contracts/proxies/Morpho/lib/MarketParamsLib.sol
  • contracts/proxies/CurveLite/ICurveLiteTwocryptoswapPool.sol
  • contracts/test/MockIzumiPool.sol
  • contracts/proxies/Agnostic/AgnosticProxy.sol
  • contracts/proxies/UniswapV2/UniswapV2Proxy.sol
  • contracts/test/interface/IMockTacSmartAccount.sol
  • contracts/proxies/CurveLite/ICurveLiteRouter.sol
  • contracts/proxies/Agnostic/ReplacementLib.sol
  • contracts/proxies/Yield/Common.sol
  • contracts/test/MockYieldManager.sol
  • contracts/proxies/CurveLite/CurveLiteStableProxy.sol
  • contracts/proxies/Zerolend/ZerolendPoolProxy.sol
  • contracts/proxies/Zerolend/interfaces/IZLSmartAccount.sol
  • contracts/proxies/Merkl/interface/IREUL.sol
  • contracts/test/UniswapInterfacesMock.sol
  • contracts/faucet/TreasurySwap.sol
  • contracts/proxies/Zerolend/interfaces/ITonToTacProxy.sol
  • contracts/proxies/Izumi/BytesLib.sol
  • contracts/faucet/interfaces/IERC20.sol
  • contracts/test/TestERC721Token.sol
  • contracts/test/MockYieldReceipt.sol
  • contracts/proxies/Morpho/Interface/IMockOracle.sol
  • contracts/proxies/Euler/Interface/IEthereumVaultConnector.sol
  • contracts/faucet/interfaces/ITreasurySwap.sol
  • contracts/proxies/CurveLite/ICurveLiteStableswapPool.sol
  • contracts/proxies/Morpho/Interface/IURD.sol
  • contracts/proxies/Morpho/MorphoProxy.sol
  • contracts/test/TestToken.sol
  • contracts/proxies/Merkl/CustomMerklProxyEuler.sol
  • contracts/proxies/Izumi/Interface/IPool.sol
  • contracts/proxies/Izumi/Interface/IFactory.sol
  • contracts/proxies/CurveLite/ICurveLiteTricryptoswapPool.sol
  • contracts/proxies/TacVault/interface/ITellerWithMultiAssetSupport.sol
  • contracts/proxies/Zerolend/interfaces/DataTypes.sol
  • contracts/proxies/Morpho/Interface/IMorpho.sol
  • contracts/proxies/Euler/EulerProxy.sol
  • contracts/proxies/Izumi/IzumiProxy.sol
  • contracts/proxies/Izumi/Interface/ILiquidityManager.sol
  • contracts/L2/AppProxy.sol
  • contracts/proxies/CurveLite/CurveLiteTricryptoProxy.sol
  • contracts/proxies/Taco/TacoProxy.sol
  • contracts/helpers/TransferHelper.sol
  • contracts/proxies/CurveLite/CurveLiteTwocryptoProxy.sol
  • contracts/faucet/TestnetERC20.sol
  • contracts/proxies/TacVault/interface/IBoringOnChainQueue.sol
  • contracts/faucet/proxy/TreasurySwapProxy.sol
  • contracts/proxies/Morpho/Interface/IMorphoVault.sol
  • contracts/proxies/Yield/YieldManagerProxy.sol
  • contracts/proxies/Zerolend/interfaces/IPool.sol
  • contracts/proxies/Morpho/mock/MockOracle.sol
  • contracts/proxies/Yield/Codec.sol
  • contracts/proxies/Yield/ISToken.sol
  • contracts/proxies/TacVault/interface/IBoringVault.sol
  • contracts/proxies/Merkl/interface/IMerkl.sol
  • contracts/proxies/Izumi/Interface/ISwap.sol
  • contracts/proxies/WTACConverterProxy/WTACConverterProxy.sol
  • contracts/test/TestSmartAccountProxyUser.sol
  • contracts/test/TestERC721EnumerableToken.sol
  • contracts/proxies/Yield/IReceipt.sol

Part of TAC’s security record

TAC
Audits2 audits by 1 firmLast audit Oct 2025, by Quantstamp.
Critical findingsNo open critical findingsAcross 2 reports.
Open TAC’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us