vusd-stablecoin

QuantstampRepository at commit 7b66754

Audit

Quantstamp reviewed vusd (vusd-stablecoin) on 6 May 2025: 10 findings, 0 critical; 3 marked fixed, 7 open.

No open critical findings
Open the reportOpen vusd’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings10

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High001
Medium001
Low701
HighStablecoin Arbitrage Leads to Potential for Vusd to Become UndercollateralizedFixed

The core invariant of the protocol is that the VUSD token should always be backed at least 1:1 by the stablecoins held in its treasury. However because VUSD tokens are minted to users based on the oracle price of the stablecoin being deposited, there is an opportunity for arbitrageurs to mint more VUSD with stablecoins that have temporarily deviated slightly above one dollar. They can then immediately redeem this VUSD for another of the whitelisted stablecoins that price has not deviated from one dollar. This scenario allows the arbitrageur to make a small profit, but more importantly means that when the deviated price of the first stable coin returns to one dollar the protocol will now be slightly undercollateralized. Over time this could be repeated whenever such a price deviation occurs to slowly force the protocol to become more and more undercollateralized.

MediumStale Oracle Price Data Not Checked Before Token Operations May Drain Assets From ProtocolFixed

The Redeemer and Minter contracts use Chainlink oracles to fetch price data for stablecoins to calculate redemption and minting amounts. However, these contracts only check if the price falls within a tolerance range but don not verify the freshness of the price data. In the `_calculateRedeemable()` function of the Redeemer contract and the `_calculateMintage()` function of the Minter contract, the code calls `latestRoundData()` but only uses the price value without checking the timestamp of when this price was last updated.

LowLack of Slippage Protection on Mint and Redeem FunctionsFixed

When minting and redeeming tokens within the protocol there is an expectation that the user will know how many tokens they are going to receive. However in certain scenarios the user may receive less tokens than they expected when they submitted the transaction. This could happen in a number of scenarios including: - The oracle price is updated, changing the value of the underlying stable coins. - The governor changes the `mintingFee` while a user's transaction is pending. In the current implementation the user has no control over this and their transaction would succeed even if the number of tokens they receive is unfavorable.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (127)

  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/interfaces/IERC20.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.husky/.gitignore at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/interfaces/IVUSD.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/remappings.txt at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/releases/1.0.0/contracts.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/interfaces/IERC1155.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/StdStyle.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.gitattributes at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/lib/ds-test/LICENSE at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/mocks/MockERC721.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/test/vusd.spec.ts at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/fixtures/test.toml at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/test/utils/address.ts at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdStorage.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/Test.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/StdJson.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/lib/ds-test/src/test.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdError.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/VUSD.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdMath.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/Vm.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/interfaces/IERC165.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.solcover.js at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deploy/01-Minter.ts at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/.gitignore at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.editorconfig at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdStyle.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.gitignore at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/releases/1.2.1/contracts.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/mocks/MockERC20.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/StdCheats.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/interfaces/curve/ICurveFactory.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/StdChains.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/test/IUniswapRouterTest.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/fixtures/broadcast.log.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/lib/ds-test/default.nix at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/.gitattributes at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.husky/pre-commit at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/fixtures/test.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/package.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.lintstagedrc.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/solcInputs/2ca97e329a6a43c8b41836cde7a46ae4.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/StdToml.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/mocks/MockERC721.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/StdError.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/StdStorage.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/StdUtils.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/releases/1.1.0/contracts.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/lib/ds-test/Makefile at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/Redeemer.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/StdAssertions.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdJson.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.solhint.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/LICENSE-MIT at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/CurveMetapool.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/test/foundry/Minter.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/Minter.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/solcInputs/39c191a09ff8c148e0d92695bc150374.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/mocks/MockERC20.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/Treasury.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdAssertions.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/package.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deploy/02-Redeemer.ts at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/lib/ds-test/.gitignore at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/solcInputs/2421f05dab484b75fab1e136c8789882.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/interfaces/chainlink/IAggregatorV3.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/README.md at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/solcInputs/40a5527d248d03a112545ff125be1878.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/releases/1.2.0/contracts.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/StdMath.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdUtils.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/lib/ds-test/package.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/Minter.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/package-lock.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/solcInputs/4250b1a14ac61511ae93302864f24eda.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/Governed.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/foundry.toml at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/README.md at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/patches/hardhat-deploy+0.7.9.patch at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/VUSD.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deploy/00-VUSD.ts at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdInvariant.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/interfaces/compound/ICompound.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/interfaces/IERC4626.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/.chainId at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/Vm.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/compilation/CompilationTestBase.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/interfaces/IMulticall3.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/test/foundry/Redeemer.t.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/console.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/compilation/CompilationScriptBase.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/lib/ds-test/src/test.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/test/treasury.spec.ts at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/interfaces/curve/ICurveMetapool.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/compilation/CompilationTest.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/console2.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.prettierrc at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/tsconfig.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/hardhat.config.ts at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deploy/03-Treasury.ts at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/LICENSE-APACHE at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/Script.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/test/compilation/CompilationScript.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/test/live-mint-redeem.spec.ts at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdToml.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/scripts/vm.py at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/Redeemer.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/interfaces/ITreasury.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/interfaces/IERC721.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/interfaces/uniswap/IUniswap.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/Treasury.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/contracts/interfaces/bloq/ISwapManager.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/releases/1.4.0/contracts.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/foundry.toml at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdChains.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/Base.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/test/utils/tokenSwapper.ts at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/.github/workflows/ci.yml at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.eslintrc.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/deployments/mainnet/solcInputs/67e43f5c13609e7c93c7e3c2c1c52dc8.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/.github/workflows/sync.yml at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/releases/1.3.0/contracts.json at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/safeconsole.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/src/StdCheats.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/lib/ds-test/demo/demo.sol at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/.nvmrc at commit 7b66754aa4e7e79aefd47361902759464bf1da54
  • https://github.com/hemilabs/vusd-stablecoin/lib/forge-std/lib/ds-test/.github/workflows/build.yml at commit 7b66754aa4e7e79aefd47361902759464bf1da54

Part of vusd’s security record

vusd
Audits1 audit by 1 firmLast audit May 2025, by Quantstamp.
Critical findingsNo open critical findingsIn 1 report.
Open vusd’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us