Strata - Discrete Accounting

Quantstamp26 Mar 2026Code version: not recorded (see the report)

Quantstamp reviewed Strata (Strata - Discrete Accounting) on 26 Mar 2026: 5 findings, 0 critical; 4 marked fixed, 1 acknowledged.

No open critical findings

Open the report Open Strata’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Acknowledged	Fixed
Critical	0	0
High	0	0
Medium	0	1
Low	1	3

MediumMidas Deposit Amount Calculation Uses Input Token Amount Instead of Shares ReceivedFixed

`MidasStrategy.deposit()` calls `depositVault.depositInstant()` with `tokenAmount`, but the Midas vault computes `mintAmount` using a fee and the current `mTokenRate` conversion in `_convertUsdToMToken()`. As a result, minted mToken output is not a guaranteed one to one representation of USDC input. After the deposit, the strategy returns the USDC base asset value to the CDO, which increases NAV through `updateBalanceFlow()`. On the next `updateAccounting()` call, `totalAssets()` reflects true mToken value, and the gap is realized as a loss that is socialized by the loss waterfall.

LowCanceled Midas Redemption Requests Leave Cooldown Proxy StuckFixed

When `MidasCooldownRequestImpl.request()` falls back to `redeemRequest()`, the proxy sets `pending = true` and stores only an expected amount, but it does not persist the external request identifier. If a Midas admin later cancels the redemption request (`RedemptionVault.rejectRequest()`, `MidasCooldownRequestImpl` has no status check or cancellation path to clear local state, so `pending` remains true and future `request()` calls revert.

LowUser Funds Stuck in the `MidasCooldownRequestImpl` Proxy if Midas Fulfills the Withdrawal Request with Less than 90% of the Expected FundsFixed

In the current implementation of the `MidasCooldownImpl` proxy contract, a user is unable to recover their funds if the Midas protocol fulfils their withdrawal request with less than 90% of the expected value. In this scenario the `finalize()` function will always revert until at least 90% of the `requestedAmount` of `baseAsset` tokens are present in the contract. This means the only way for a user to successfully recover the funds in this scenario would be to transfer the necessary amount of `baseAssets` into the contract to reach the `requestedAmount` value, unlocking the `finalize()` function and allowing them to redeem the contract's entire `baseAsset` token balance.

LowZero Slippage Protection on Midas Deposits and RedemptionsFixed

In `MidasStrategy.deposit()`, the `minReceiveAmount` for `depositVault.depositInstant()` is hardcoded to `0`. Similarly, in `MidasCooldownRequestImpl.request()`, the `minReceiveAmount` for `redemptionVault.redeemInstant()` is also `0`. While Midas uses oracle-based pricing (reducing traditional AMM sandwich risk), a rate change between submission and execution, an oracle update mid-block, or a fee change by the Midas admin could cause the strategy to receive significantly fewer tokens than expected with no revert threshold.