Copra Finance audit
Audit competition · firm’s term: security review
Sherlock reviewed Copra (Copra Finance audit) on 21 Mar 2024: 13 findings, 0 critical; 11 marked fixed, 2 acknowledged.
Findings13
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 2 | 9 |
| Low | 0 | 0 | 0 |
HighMalicious Data Injection via TeahouseLiquidityWarehouse._withdrawFromTargetFixed
The report gives no description here.
HighUnderlying LP value can be manipulated to drain teahouse and orange warehousesFixed
The report gives no description here.
MediumImpossible to execute whitelisted actions and send the native token within the same execution.Fixed
The report gives no description here.
MediumIncorrect decimal handling inside _compound-Interest functionFixed
The report gives no description here.
MediumInterest will be compounded even when the protocol is inactiveFixed
The report gives no description here.
MediumLiquidityWarehouse::depositBorrower is susceptible to inflation attacksFixed
The report gives no description here.
MediumSteadefi WETH vault cannot facilitate withdrawals when there is insufficient WETH liquidityFixed
The report gives no description here.
MediumTeavaultPairHelper is called instead of TeaVaultV3Pair to fetch balanceFixed
The report gives no description here.
MediumWhile doing a deposit, lenders can reenter the withdrawLender() while their LENDER_LP_TOKENS are been minted to force the LiquidityWarehouse to withdraw the liquidity from the withdrawTargetsFixed
The report gives no description here.
MediumwithdrawAmount is incorrect when processing withdrawals from TeahouseLiquidityWarehouseFixed
The report gives no description here.
Show 1 more
MediumWithdrawing all assets from TeaHouse will fail due to overflowFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Copra’s security record
CopraSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us