YuzuUSD security review
Audit · firm’s term: security review
Pashov Audit Group reviewed Yuzu Money (YuzuUSD security review) on 1 Sep 2025: 18 findings, 0 critical; 16 marked fixed, 2 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings18
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 2 | 11 |
HighFee avoidance possible by uncollected fees in pool accountingFixed
The report gives no description here.
HighNon-atomic updatePool() enables sandwich attacks and extractionFixed
The report gives no description here.
HighPending withdrawals in YuzuILP contract are not considered in totalAssets calculationFixed
The report gives no description here.
MediumMissing slippage protection allows unexpected asset amountsFixed
The report gives no description here.
MediumSandwiching yield distributions allows users to profit from redemptionFixed
The report gives no description here.
LowDust withdrawals block admin collateral by reducing liquidityBufferSizeFixed
The report gives no description here.
LowExcessively large max values allowed in setRedeemDelay() and setFillWindow()Fixed
The report gives no description here.
LowIncorrect rounding in YuzuProto.previewWithdraw()Fixed
The report gives no description here.
LowIncorrect rounding on incentive calculation in _applyFeeOrIncentiveOnTotal()Fixed
The report gives no description here.
LowLack of minimum redemption causes spam for ORDER_FILLER_ROLEFixed
The report gives no description here.
Show 6 more
LowmaxWithdraw() return values exceed actual withdrawable amounts due to fee exclusionFixed
The report gives no description here.
LowMissing initialization call for PausableUpgradeabl e contractFixed
The report gives no description here.
LowMissing lower bound check for redeem order incentiveFixed
The report gives no description here.
LowReturned shares token decimals wrong if asset has over 6 decimalsFixed
The report gives no description here.
LowStakedYuzuUSD violates the ERC4626 standardFixed
The report gives no description here.
LowUsers can frontrun to escape ILP losses by forfeiting small yieldFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Yuzu Money’s security record
Yuzu MoneySecurity firm
Pashov Audit Group86 projects reviewed · 165 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us