Tori Finance audit
Sherlock reviewed Tori Finance (Tori Finance audit) on 22 Jan 2026: 22 findings, 0 critical; 15 marked fixed, 7 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings22
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 2 | 5 |
| Low | 0 | 5 | 9 |
HightransferToCustody() function always reverts due to incorrect validation of ERC20 token address against EOA checkFixed
The report gives no description here.
MediumBlacklisted shares continue earning rewards during vesting periodFixed
The report gives no description here.
MediumMissing FULL_RESTRICTED_STAKER_ROLE check in StakedTrUSD _deposit allows sanctioned entities to deposit fundsFixed
The report gives no description here.
MediumRounding errors in ratio calculations can leave unaccounted tokens in the contractFixed
The report gives no description here.
MediumSOFT_RESTRICTED_STAKER_ROLE can bypass restrictions and withdraw with yieldFixed
The report gives no description here.
MediumStakedTrUSD.reportLoss is blocked during vesting, preventing handling of bad debt and allowing users to exit fully, forcing remaining stakers to bear the lossFixed
The report gives no description here.
LowCompilation Failure Due to ReentrancyGuardUpgradeable Removal in OpenZeppelin v5.5Fixed
The report gives no description here.
LowCooldown duration changes create unfair waiting periodsFixed
The report gives no description here.
LowEvent parameter order inconsistencyFixed
The report gives no description here.
LowMisleading error message in blacklist access controlFixed
The report gives no description here.
Show 5 more
LowMissing validation allows rate limit window to be set to zeroFixed
The report gives no description here.
LowNo way to cancel or reduce cooldown requestsFixed
The report gives no description here.
LowOwner can be blacklisted in StakedTrUSDOFT and causing cross-chain transfers to failFixed
The report gives no description here.
LowrescueOrphanFunds fails to reset vestingAmount causing temporary DoSFixed
The report gives no description here.
LowRewardsReceived event emits identical valuesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Tori Finance’s security record
Tori FinanceSecurity firm
Sherlock5 projects reviewed · 7 reports · latest Jun 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us