Cybro V3

QuillAuditsFiles named in the report

Audit · firm’s term: audit report

QuillAudits reviewed CYBRO (Cybro V3) on 12 Feb 2025: 7 findings, 0 critical; 3 marked fixed, 4 open.

No open critical findings
Open the reportOpen CYBRO’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings7

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium201
Low201
HighRebalanceAuto() does not check for swap on zero amountFixed

In rebalanceAuto(), It automatically rebalances assets across all lending pools part of what it does is iterate through all lending pool with a for loop, executing redeem on each pool and then swapping it to the pool asset, However it never checks the amount returned on the redeem() to be above 0 before executing the swap as it is a possibility for one of the pool being iterated on to return 0 on redeem and also since the redeem function default is to round down. This unhandled zero amount going into a swap will always revert the entire rebalanceAuto(). Therefore, if one of the pool.redeem() returns zero the entire rebalanceAuto() will fail.

MediumFor cases when fee returned is zero _applyPerfor manceFee will revert entire parent operations in some tokens.Fixed

Unlike in _applyWithdrawalFee where fee > 0 is first checked before making a transfer, _applyPer formanceFee does not check if fee > 0 before making the performancefee transfer, this will cause operations that makes call to _applyPerformanceFee to revert for some tokens for cases when fee returned is zero. Transferring performance fee without checking if fee > 0 could cause the entire parent operations to revert for some tokens.

LowsetFeesForUsers() Called Before getUpdateUser Fees() Results in Zero Fees for UsersFixed

user fees properly if getUpdateUserFees() has not been called before. When setFeesForUsers() is executed:. The function sets the user’s fees using Math.min() with the default uninitialized value (0) from _users[user]. . Since userFees.depositFee, userFees.withdrawalFee, and userFees.performanceFee are not initial ized, they default to 0. . As a result, the user’s fees are always set to 0, overriding the global fee settings. . getUpdateUserFees() is expected to initialize fees, but if setFeesForUsers() is called first, the fees will remain 0.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (7)

  • src/vaults/AaveVault.sol
  • src/FeeProvider.sol
  • sol
  • src/Exchange.sol
  • src/BaseVault.sol
  • src/Oracle.sol
  • src/OneClickIndex.sol

Part of CYBRO’s security record

CYBRO
Audits4 audits by 2 firmsLast audit Feb 2025, by CertiK.
Critical findingsNo open critical findingsAcross 4 reports.
Open CYBRO’s security record

Security firm

QuillAudits

350 projects reviewed · 459 reports · latest Apr 2025

See QuillAudits’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us