YieldFi Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed YieldFi (YieldFi Audit Report) on 24 Apr 2025: 15 findings, 2 critical; all marked fixed.
The original report was removed from its address (seen 16 Oct 2026).
Trustblock does not review code.
Findings15
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 5 |
| Low | 0 | 0 | 7 |
CriticalAll CCIP messages reverts when decodedFixed
The report gives no description here.
CriticalMissing source validation in CCIP message handlingFixed
The report gives no description here.
HighIncorrect owner passed to Manager::redeem in YToken withdrawal flowFixed
The report gives no description here.
MediumCommented-out blacklist check allows restricted transfersFixed
The report gives no description here.
MediumDirect YToken deposits can lock funds below minimum withdrawal thresholdFixed
The report gives no description here.
MediumManager::_transferFee returns invalid feeShares when fee is zeroFixed
The report gives no description here.
MediumMissing L2 sequencer uptime check in OracleAdapterFixed
The report gives no description here.
MediumYtokenL2::previewMint and YTokenL2::previewWithdraw round in favor of userFixed
The report gives no description here.
LowBalance check for yield claims in PerpetualBond::_validate can be easily bypassedFixed
The report gives no description here.
LowChainlink router configured twiceFixed
The report gives no description here.
Show 5 more
LowHardcoded CCIP feeToken prevents LINK discount usageFixed
The report gives no description here.
LowHardcoded extraArgs violates CCIP best practicesFixed
The report gives no description here.
LowMissing vesting check in PerpetualBond::setVestingPeriodFixed
The report gives no description here.
LowStatic gasLimit will result in overpaymentFixed
The report gives no description here.
LowUnverified _receiver can cause irrecoverable token lossFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of YieldFi’s security record
YieldFiSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us