Beefy Concentrated Liquidity Strategy Audit
Audit · firm’s term: audit report
Cyfrin reviewed Beefy (Beefy Concentrated Liquidity Strategy Audit) on 6 Apr 2024: 16 findings, 1 critical; 12 marked fixed, 4 acknowledged.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 1 | 0 |
| Medium | 0 | 2 | 2 |
| Low | 0 | 1 | 9 |
CriticalAttacker can drain protocol tokens by sandwich attacking owner call to setPositionWidth and unpause to force redeployment of Beefy’s liquidity into an unfavorable rangeFixed
The report gives no description here.
MediumNative tokens permanently stuck in StrategyPassiveManagerUniswap contract due to rounding in _chargeFeesFixed
The report gives no description here.
MediumStrategyPassiveManagerUniswap gives ERC20 token allowances to unirouter but doesn’t remove allowances when unirouter is updatedFixed
The report gives no description here.
Low_onlyCalmPeriods does not consider MIN/MAX ticks, which can DOS deposit, withdraw and harvest in edge casesFixed
The report gives no description here.
LowDeposit can return zero shares when user deposits a positive amount of tokensFixed
The report gives no description here.
LowMissing storage gap in StratFeeManagerInitializable can lead to upgrade storage slot collisionFixed
The report gives no description here.
LowOwner of StrategyPassiveManagerUniswap can rug-pull users’ deposited tokens by manipulating onlyCalmPeriods parametersFixed
The report gives no description here.
LowSome tokens will be stuck in the protocol foreverFixed
The report gives no description here.
LowStrategyPassiveManagerUniswap::price will revert due to overflow for large but valid sqrtPriceX96Fixed
The report gives no description here.
LowStrategyPassiveManagerUniswap::withdraw should call _setTicks before calling _addLiquidityFixed
The report gives no description here.
Show 2 more
LowUpgradeable contracts don’t call disableInitializersFixed
The report gives no description here.
LowWithdraw can return zero tokens while burning a positive amount of sharesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Beefy’s security record
BeefySecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us