Vesu protocol security review

Cairo Security Clan12 Mar 2025Repository at commit 5f1274f

Audit · firm’s term: security review

Cairo Security Clan reviewed Vesu (Vesu protocol security review) on 12 Mar 2025: 2 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Vesu’s security record

Report stored on IPFS. Content hash bafybeicuxsnik3ibvhgkmgwnimaerxqwquosbi2o4lkpxvztt4737y4emu

Trustblock does not review code.

Findings2

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	0	0	2

LowApproval amount is more than needed in case add_margin_is_wrapped trueFixed

When add_margin_is_wrapped is true, the margin asset deposited is already the wrapped vault token. The transfer logic excludes margin_amount properly, but approval logic unnecessarily approves the sum of margin_amount and lever_amount for the debt asset causing over-approval, which is inefficient and could pose security risks. Recommendation is to approve only lever_amount when add_margin_is_wrapped is true.

LowMissing check for add_margin_is_wrapped when swapping margin asset to debt assetFixed

The multiply4626 contract swaps the margin token to the debt token if needed, but lacks a check to enforce add_margin_is_wrapped is false when swapping occurs. This could cause incorrect logic flows. Recommendation is to add a check to ensure add_margin_is_wrapped is false when swapping margin asset to debt asset.