Yield Basis
Quantstamp reviewed Yield Basis on 25 Apr 2025: 6 findings, 0 critical; all marked fixed.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings8
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 0 | 1 |
HighIncorrect Flashloan IntegrationFixed
The `VirtualPool` contract makes use of a crvUSD flashloan provider to amplify user arbitrage for price correction. However, the flashloan integration is incomplete. 1. The `onFlashLoan()` function needs to be external according to ERC3156. 2. The `onFlashLoan()` function should verify the `initiator` and `token` addresses. 3. The `exchange()` function calls a `FLASH.ceiling()` function that appears to be undefined based on the intended integrated flash contract, [Curve Flashlender](https://etherscan.io/address/0x26de7861e213a5351f6ed767d00e0839930e9ee1#code). 4. The `exchange()` function should be `@nonreentrant`.
HighNo Fee Enforcement in `LT` ContractFixed
`LT.min_admin_fee` is never assigned, preventing any admin fees to be charged from the LT contract.
HighStaker Address Update Does Not Transfer Staker's BalanceFixed
If the `set_staker()` function is called and the `staker` address is updated without transferring the previous staker's `balanceOf` to the new staker, the following issues could arise: 1. The previous staker's balance would remain with the old staker's address, leaving the new staker with a zero balance. This could lead to a situation where the new staker cannot perform any operations that require a balance, such as withdrawing staked tokens. 2. Incorrect calculations of staked tokens would result in the `_calculate_values()` function producing different values than expected.
MediumOverleveraging After Allocator's Stablecoins Are ReclaimedFixed
If the `Factory` contract `admin` were to reclaim the `Factory`'s allocated crvUSD from the `AMM` contract via `LT.allocate_stablecoins()`, the `LT` contract debt could become higher than half of the available crvUSD. In such a case, the protocol could become insolvent, resulting in halted deposits and imbalanced reserves, potentially preventing the execution of the `AMM.exchange()` function.
MediumStaker Is Not Updated in Some CasesFixed
If the `Factory` creates a market using `add_market()` before a `staker_impl` is set, a staker can be added later by calling the `fill_staker_vpool()` function. However, this function does not call the `LT.setStaker()` function to update the staker in the `LT` contract.
LowMissing Setter Function for `staker_impl`Fixed
In the function `fill_staker_vpool()`, a `staker` contract is deployed for the given `market` if the `staker_impl` contract address is set and if the `staker` contract was not already deployed from executing `add_market()`. However, the `staker_impl` contract address is not updatable in the `Factory` contract. Therefore, if the `staker_impl` is not set during deployment, the `staker` contract will not be deployed when `fill_staker_vpool()` is called as the following code block will never execute: ``` if market.staker == empty(address) and self.staker_impl != empty(address): market.staker = create_from_blueprint( self.staker_impl, market.lt) ```
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (28)
- https://github.com/yield-basis/yb-core/contracts/CryptopoolLPOracle.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/pyproject.toml at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/testing/DummyPriceOracle.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/VirtualPool.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/testing/FlashLender.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/tests/lt/test_factory.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/LT.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/tests/amm/test_adiabatic_trade.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/testing/ERC20Mock.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/scripts/demo-one-pool.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/tests/lt/test_price_return.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/tests/lt/conftest.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/testing/twocrypto/CurveTwocryptoOptimized.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/testing/twocrypto/CurveCryptoMathOptimized2.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/testing/twocrypto/CurveTwocryptoFactory.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/tests/lt/script_plot_deposits.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/.flake8 at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/Factory.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/tests/lt/test_st_staker.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/poetry.lock at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/testing/twocrypto/CurveCryptoViews2Optimized.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/tests/conftest.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/tests/amm/test_unitary.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/contracts/AMM.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/hardhat.config.js at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/tests/lt/test_unitary.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/.gitignore at commit 16b17801efabd430656d899b1b4ab672f836f0fc
- https://github.com/yield-basis/yb-core/tests/amm/test_stateful.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
Part of Yield Basis’s security record
Yield BasisSecurity firm
Quantstamp240 projects reviewed · 338 reports · latest Nov 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us