vesu protocol security review

Cairo Security Clan9 Jun 2024Files named in the report

Audit · firm’s term: security review

Cairo Security Clan reviewed Vesu (vesu protocol security review) on 9 Jun 2024: 3 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Vesu’s security record

Report stored on IPFS. Content hash bafybeierrz36xnlcamixhpwbz24xjbpsnvp6kpgztc6h6eacpjazvuxopa

Trustblock does not review code.

Findings3

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	0	0	3

Lowinsufficient partial swap checkFixed

The vesu liquidate contract uses Ekubo for token swaps where a route consists of multiple token pairs. The sqrt_ratio_limit for each pair constrains the maximum and minimum trade prices. If the limit is set too close to the current market price, Ekubo might not have sufficient liquidity to complete the entire swap, leading to partial swaps. The contract currently checks only the first swap for partial execution but not subsequent swaps.

Lowliquidateresponse event should include token address to avoid confusionFixed

In the liquidate_position function, the liquidateresponse event emits the residual_collateral amount. If the residual collateral is swapped for another token, this amount then refers to the new token amount, which can cause confusion and impact UI/UX. The audit recommends including the output token address in the event.

Lowusers are forced to liquidate all debt of the positionFixed

The vesu liquidate contract requires users to liquidate the entire debt of a position in a single transaction. This mandatory full liquidation can limit flexibility and negatively affect swap prices on Ekubo, potentially resulting in unprofitable liquidations. The audit suggests allowing partial liquidations to provide greater flexibility.