Nuva Labs audit
Audit · firm’s term: collaborative audit
Sherlock reviewed NUVA (Nuva Labs audit) on 5 Dec 2025: 36 findings, 0 critical; 20 marked fixed, 16 acknowledged.
Findings36
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 5 | 7 |
| Low | 0 | 11 | 12 |
MediumGenesis import missing PayoutVerificationSet restorationAcknowledged
The report gives no description here.
MediumhandleVaultInterestTimeouts dequeues timeout but does not re-enqueue on failureAcknowledged
The report gives no description here.
MediumMissing slippage protection in swap and bridge operationsAcknowledged
The report gives no description here.
MediumNAV staleness during cooldownAcknowledged
The report gives no description here.
MediumWithdrawal queue griefing via batch limitAcknowledged
The report gives no description here.
LowAutoCLI positional arguments order mismatch with proto field definitionsAcknowledged
The report gives no description here.
LowContracts do not account for fee-on-transfer tokensAcknowledged
The report gives no description here.
LowInitGenesis calls SetVaultLookup twice for same vaultAcknowledged
The report gives no description here.
LowLack of atomicity in withdrawal processing leads to potential double spending.Acknowledged
The report gives no description here.
LowLack of decimal normalization in cross-chain transfersAcknowledged
The report gives no description here.
Show 6 more
LowMaxSwapOutBatchSize should be governance parameterAcknowledged
The report gives no description here.
LowMissing Cosmos SDK invariantsAcknowledged
The report gives no description here.
LowNo user-initiated cancellation for pending withdrawalsAcknowledged
The report gives no description here.
LowPayment Denom NAV stalenessAcknowledged
The report gives no description here.
LowSystematic yield loss due to interest truncation on short intervals.Acknowledged
The report gives no description here.
LowWithdraw function actually deposits tokensAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of NUVA’s security record
NUVASecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us