Nuva Labs audit
Audit · firm’s term: collaborative audit
Sherlock reviewed NUVA (Nuva Labs audit) on 5 Dec 2025: 36 findings, 0 critical; 20 marked fixed, 16 acknowledged.
Findings36
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 5 | 7 |
| Low | 0 | 11 | 12 |
HighTokenFactory transfer/allowance functions are non-functionalFixed
The report gives no description here.
MediumAML signature lacks chain id bindingFixed
The report gives no description here.
MediumautoPauseVault sets zero PausedBalance due to circular dependencyFixed
The report gives no description here.
MediumCritical logic error in _doDeposit allows infinite bridge minting via self-transferFixed
The report gives no description here.
MediumGriefing attack via residual dust and incorrect initial mint conditionFixed
The report gives no description here.
MediumMissing access control on factory contract creation functionsFixed
The report gives no description here.
MediumNo mechanism to recover accumulated dustFixed
The report gives no description here.
MediumUnpausing vault does not re-enable interest accrual periodFixed
The report gives no description here.
LowContract has no admin transfer mechanismFixed
The report gives no description here.
LowCustomToken constructor contains redundant zero amount mintFixed
The report gives no description here.
Show 10 more
LowIncomplete zero checks in UnitPriceFra ctionFixed
The report gives no description here.
LowMissing Defensive Allowlist Check in TVV CalculationFixed
The report gives no description here.
LowMustAccAddressFromBech32 usage on state dataFixed
The report gives no description here.
LowQuery endpoints ignore error returns from GetVaultFixed
The report gives no description here.
LowReceipt ID collision riskFixed
The report gives no description here.
LowUse Ownable2Step instead of Ownable for factory contractsFixed
The report gives no description here.
LowValidateInterestRateLimits bypasses validation when only one limit is setFixed
The report gives no description here.
LowVault state changes bypass validation via direct AuthKeeper.SetAccountFixed
The report gives no description here.
LowWithdrawal contract grants excessive admin privileges to burnUserFixed
The report gives no description here.
LowZero assets with non-zero shares allows share inflationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of NUVA’s security record
NUVASecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us