Strata PreDeposit Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Strata (Strata PreDeposit Audit Report) on 11 Jun 2025: 21 findings, 1 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 0 | 16 |
CriticalAn attacker can drain the entire protocol balance of sUSDe during the yield phase due to incorrect redemption accounting logic in pUSDeVault::_withdrawFixed
The report gives no description here.
HighDuring the yield phase, when using supported vaults, users can’t withdraw vault assets they are entitled toFixed
The report gives no description here.
MediumDoS of meta vault withdrawals during points phase if one vault is paused or attempted redemption exceeds the maximumFixed
The report gives no description here.
MediumMetaVault::redeemRequiredBaseAssets should be able to redeem small amounts from each vault to fill requested amount and avoid redeeming more than requestedFixed
The report gives no description here.
MediumValue leakage due to pUSDe redemptions rounding against the protocol/yUSDe depositorsFixed
The report gives no description here.
LowDuplicate vaults can be pushed to assetsArrFixed
The report gives no description here.
LowHard-coded slippage in pUSDeDepositor::deposit_viaSwap can lead to denial of serviceFixed
The report gives no description here.
LowIn pUSDeDepositor::deposit_viaSwap, using block.timestamp in swap deadline is not very effectiveFixed
The report gives no description here.
LowInability to remove and redeem from vaults with withdrawal issues could result in a bank-runFixed
The report gives no description here.
LowMetaVault::addVault should enforce identical underlying base assetFixed
The report gives no description here.
Show 10 more
LowMetaVault::redeem erroneously calls ERC4626Upgradeable::withdraw when attempting to redeem USDe from pUSDeVaultFixed
The report gives no description here.
LowNo way to compound deposited supported vault assets into sUSDe stake during yield phaseFixed
The report gives no description here.
LowpUSDeVault::maxDeposit doesn’t account for deposit pausing, in violation of EIP-4626 which can break protocols integrating with pUSDeVaultFixed
The report gives no description here.
LowpUSDeVault::maxMint doesn’t account for mint pausing, in violation of EIP-4626 which can break protocols integrating with pUSDeVaultFixed
The report gives no description here.
LowpUSDeVault::maxRedeem doesn’t account for redemption pausing, in violation of EIP-4626 which can break protocols integrating with pUSDeVaultFixed
The report gives no description here.
LowpUSDeVault::maxWithdraw doesn’t account for withdrawal pausing, in violation of EIP-4626 which can break protocols integrating with pUSDeVaultFixed
The report gives no description here.
LowpUSDeVault::startYieldPhase should not remove supported vaults from being supported or should prevent new supported vaults once in the yield phaseFixed
The report gives no description here.
LowUpgradeable contracts which are inherited from should use ERC7201 namespaced storage layouts or storage gaps to prevent storage collisionFixed
The report gives no description here.
LowUse SafeERC20::forceApprove instead of standard IERC20::approveFixed
The report gives no description here.
LowyUSDeVault edge cases should be explicitly handled to prevent view functions from revertingFixed
The report gives no description here.
Show 1 more
LowyUSDeVault inherits from PreDepositVault but doesn’t call onAfter- DepositChecks or onAfterWithdrawalChecksFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Strata’s security record
StrataSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us