Beefy Concentrated Liquidity Strategy Audit
Audit · firm’s term: audit report
Cyfrin reviewed Beefy (Beefy Concentrated Liquidity Strategy Audit) on 6 Apr 2024: 16 findings, 1 critical; 12 marked fixed, 4 acknowledged.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 1 | 0 |
| Medium | 0 | 2 | 2 |
| Low | 0 | 1 | 9 |
Marked Gas or Informational by the firm. Not counted as findings.
GasCache array length outside of loops and consider unchecked loop incrementingAcknowledged
The report gives no description here.
GasCache storage variables in memory when read multiple times without being changedAcknowledged
The report gives no description here.
GasFail fast in BeefyVaultConcLiq:withdrawAcknowledged
The report gives no description here.
GasOptimize StrategyPassiveManagerUniswap::_chargeFees to remove unnecessary variables and eliminate duplicate storage readsAcknowledged
The report gives no description here.
GasStorage variables only assigned once in the constructor can be declared immutableAcknowledged
The report gives no description here.
InformationalUse a specific version of Solidity instead of a wide versionAcknowledged
The report gives no description here.
InformationalUse Ownable2StepUpgradeable instead of OwnableUpgradeable, Ownable2Step instead of OwnableAcknowledged
The report gives no description here.
InformationalUsing pool.slot0 can be easily manipulatedAcknowledged
The report gives no description here.
GasAvoid unnecessary initialization to zero in BeefyVaultConcLiq::depositFixed
The report gives no description here.
InformationalConsider enforcing a min TWAP interval in StrategyPassiveManagerUniswap::setTwapInterval to avoid dangerous assignmentFixed
The report gives no description here.
Show 8 more
GasDon’t call _tickDistance twice in StrategyPassiveManagerUniswap::_setMainTickFixed
The report gives no description here.
GasIn StrategyPassiveManagerUniswap public functions should cache common inputs then pass them as parameters to private functionsFixed
The report gives no description here.
Informationalpublic functions not used internally could be marked externalFixed
The report gives no description here.
InformationalRename StrategyPassiveManagerUniswap::price to scaledUpPrice to explicitly indicate returned price is scaled upFixed
The report gives no description here.
InformationalStrategyPassiveManagerUniswap::twapInterval should be uint32Fixed
The report gives no description here.
GasUse calldata instead of memory for function arguments that do not get mutatedFixed
The report gives no description here.
InformationalUse existing available function in BeefyVaultConcLiq::balancesFixed
The report gives no description here.
InformationalUse existing price function in StrategyPassiveManagerUniswap::_setAltTickFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Beefy’s security record
BeefySecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us