Strata - Discrete Accounting

Quantstamp26 Mar 2026Code version: not recorded (see the report)

Quantstamp reviewed Strata (Strata - Discrete Accounting) on 26 Mar 2026: 5 findings, 0 critical; 4 marked fixed, 1 acknowledged.

No open critical findings

Open the report Open Strata’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	1
Low	1	3

LowOracle Staleness Not Validated in `getOracleRate()`Acknowledged

`getOracleRate()` calls `oracle.latestRoundData()` but only validates that `answer > 0`. It does not check the `updatedAt` timestamp for staleness. If the custom aggregator v3 feed stops updating, the strategy would continue using a stale rate for all conversions, affecting deposits, withdrawals, `totalAssets()`, and NAV calculations. The oracle updates by Midas are infrequent, occurring around every 2-5 days, so a staleness threshold should be chosen with some headroom. Note that the overloaded `totalAssets(latestNav, timestamp)` does check `updatedAt` against the accounting timestamp, but `getOracleRate()` which is used in `convertToAssets` and `convertToTokens` for all other operations does not.