Cybro V3

QuillAudits12 Feb 2025Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed CYBRO (Cybro V3) on 12 Feb 2025: 7 findings, 0 critical; 3 marked fixed, 4 open.

No open critical findings

Open the report Open CYBRO’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	1
Medium	2	1
Low	2	1

MediumRewards will forever be unclaimableOpen

No method for users or protocol to claim the incentives that Aave distributes to suppliers. E.g In Arbitrum, the aave rewards contract, currently this contract is still available for rewards claiming. However, since the contract does not include functionality to claim Aave incentives in its initial design, these rewards will forever be unclaimable. The lack of incentive claiming functionality may discourage users from using the vault contract, as they would miss out on additional earnings.

MediumSmall ETH Amounts Are Rounded Down to Zero in _convertETHToUSDB()Open

The _convertETHToUSDB() function converts ETH to USDB using a price oracle. However, for small input amounts (e.g., 1000 wei), the computation rounds down to zero due to multiple divisions in a f ixed-point arithmetic setup. If volume is too small (e.g., 1000 wei), the result rounds to 0 due to Solidity’s integer division truncating decimals.

LowMissing lendingPoolAddresses on setLending Shares() could affect protocol accountingOpen

setLendingShares() which is called be manager role does not check if pool is added or has not been removed lendingPoolAddresses by the strategist role before updating the totalLendingShares, if this happens it could affect entire protocol accounting due to additional LendingShares for pool address that are not in the lendingPoolAddresses

LowNo Restriction on Setting 100% Withdrawal Fee Despite Documentation LimitationsOpen

According to the project’s documentation, the withdrawal fee cannot be set to 100%, ensuring that users can always withdraw a portion of their funds. However, the setFees() function does not enforce this restriction, allowing the owner to set _withdrawalFee to 100%, effectively preventing users from withdrawing their assets