YieldFi Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed YieldFi (YieldFi Audit Report) on 24 Apr 2025: 15 findings, 2 critical; all marked fixed.
The original report was removed from its address (seen 16 Oct 2026).
Trustblock does not review code.
Findings15
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 5 |
| Low | 0 | 0 | 7 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalPotential risk if callback logic is enabled in the futureAcknowledged
The report gives no description here.
GasUnnecessary external call in YToken::_decimalsOffset and YTokenL2::_decimalsOffsetAcknowledged
The report gives no description here.
Informational_receiverGas check excludes minimum acceptable valueFixed
The report gives no description here.
InformationalAccess to LockBox::unlock doesn’t follow principle of least privilegeFixed
The report gives no description here.
GasbondFaceValue read in PerpetualBond::_convertToBond can be cachedFixed
The report gives no description here.
GasBridgeCCIP.isL1 can be immutableFixed
The report gives no description here.
InformationalLack of _disableInitializers in upgradeable contractsFixed
The report gives no description here.
InformationalLack of event emissions on important state changesFixed
The report gives no description here.
InformationalOrder not eligible at eligibleAtFixed
The report gives no description here.
GasOrder read twice in Manager::executeOrderFixed
The report gives no description here.
Show 4 more
InformationalPerpetualBond.epoch not updated after yield distributionFixed
The report gives no description here.
InformationalUnused constantsFixed
The report gives no description here.
InformationalUnused errorsFixed
The report gives no description here.
InformationalUnused importsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of YieldFi’s security record
YieldFiSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us