Vesu protocol security review

Cairo Security Clan29 Jun 2024Files named in the report

Audit · firm’s term: security review

Cairo Security Clan reviewed Vesu (Vesu protocol security review) on 29 Jun 2024: 9 findings, 0 critical; 8 marked fixed, 1 open.

No open critical findings

Open the report Open Vesu’s security record

Report stored on IPFS. Content hash bafybeidoep4tvimqgd6ms7xazrffhaew2bfxiynhosyt4a3saj7adlpcp4

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	0
Medium	0	2
Low	1	6

MediumFunction attribute_fee_shares not called when writing new asset config results in fee being stuck in singletonFixed

When writing new asset config to storage, attribute_fee_shares is sometimes not called, causing total_collateral_shares to increase but shares not accounted in any address. This results in shares that cannot be redeemed and remain stuck indefinitely.

MediumThe invalid price could be used for liquidation in normal modeFixed

Given that the operator precedence in the before_liquidate_position function only checks price validity for recovery mode, invalid prices could be used for liquidation in normal mode. The price fetched from the pragma oracle might be a timeout price or have fewer sources but still be accepted for liquidation.

LowInconsistent ltv config validation between create_pool and set_ltv_configFixed