Audit · firm’s term: audit report
QuillAudits reviewed CYBRO (Cybro V3) on 12 Feb 2025: 7 findings, 0 critical; 3 marked fixed, 4 open.
Report hosted on quillaudits.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 2 | 0 | 1 |
| Low | 2 | 0 | 1 |
In rebalanceAuto(), It automatically rebalances assets across all lending pools part of what it does is iterate through all lending pool with a for loop, executing redeem on each pool and then swapping it to the pool asset, However it never checks the amount returned on the redeem() to be above 0 before executing the swap as it is a possibility for one of the pool being iterated on to return 0 on redeem and also since the redeem function default is to round down. This unhandled zero amount going into a swap will always revert the entire rebalanceAuto(). Therefore, if one of the pool.redeem() returns zero the entire rebalanceAuto() will fail.
Unlike in _applyWithdrawalFee where fee > 0 is first checked before making a transfer, _applyPer formanceFee does not check if fee > 0 before making the performancefee transfer, this will cause operations that makes call to _applyPerformanceFee to revert for some tokens for cases when fee returned is zero. Transferring performance fee without checking if fee > 0 could cause the entire parent operations to revert for some tokens.
user fees properly if getUpdateUserFees() has not been called before. When setFeesForUsers() is executed:. The function sets the user’s fees using Math.min() with the default uninitialized value (0) from _users[user]. . Since userFees.depositFee, userFees.withdrawalFee, and userFees.performanceFee are not initial ized, they default to 0. . As a result, the user’s fees are always set to 0, overriding the global fee settings. . getUpdateUserFees() is expected to initialize fees, but if setFeesForUsers() is called first, the fees will remain 0.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (7)
350 projects reviewed · 459 reports · latest Apr 2025
See QuillAudits’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us