Yield Basis

QuantstampRepository at commit 16b1780

Audit

Quantstamp reviewed Yield Basis on 25 Apr 2025: 6 findings, 0 critical; all marked fixed.

No open critical findings
Open the reportOpen Yield Basis’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High003
Medium002
Low001

Marked Informational by the firm. Not counted as findings.

Informational`LT` Does Not Expose Burn FunctionalityAcknowledged

The `LT` contract also serves as a ERC20 liquidity token. The `_transfer` function attempts to stop token burns by disallowing transfers to the zero address or the token contract, but no other burn function is exposed to properly handle this. Users may still choose to burn tokens by transferring them to irretrievable addresses instead, making lively tokens harder to track.

InformationalCurve Cryptopool `donate()` Function Is Poorly DefinedAcknowledged

Using the `distrubute_borrower_fees()` function, anyone can force the `LT` contract to collect the fees from the releveraging AMM and donate them to the underlying curve liquidity pool. It is unclear how this function works in detail, as only a stub is provided. Therefore the purpose of the `min_amount` parameter is also unclear.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (28)

  • https://github.com/yield-basis/yb-core/contracts/CryptopoolLPOracle.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/pyproject.toml at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/testing/DummyPriceOracle.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/VirtualPool.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/testing/FlashLender.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/tests/lt/test_factory.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/LT.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/tests/amm/test_adiabatic_trade.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/testing/ERC20Mock.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/scripts/demo-one-pool.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/tests/lt/test_price_return.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/tests/lt/conftest.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/testing/twocrypto/CurveTwocryptoOptimized.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/testing/twocrypto/CurveCryptoMathOptimized2.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/testing/twocrypto/CurveTwocryptoFactory.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/tests/lt/script_plot_deposits.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/.flake8 at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/Factory.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/tests/lt/test_st_staker.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/poetry.lock at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/testing/twocrypto/CurveCryptoViews2Optimized.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/tests/conftest.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/tests/amm/test_unitary.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/contracts/AMM.vy at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/hardhat.config.js at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/tests/lt/test_unitary.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/.gitignore at commit 16b17801efabd430656d899b1b4ab672f836f0fc
  • https://github.com/yield-basis/yb-core/tests/amm/test_stateful.py at commit 16b17801efabd430656d899b1b4ab672f836f0fc

Part of Yield Basis’s security record

Yield Basis
Audits2 audits by 2 firmsLast audit Apr 2025, by Quantstamp.
Critical findingsNo open critical findingsAcross 2 reports.
Open Yield Basis’s security record

Security firm

Quantstamp

240 projects reviewed · 338 reports · latest Nov 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us