Royco Day
Audit · firm’s term: security assessment
Certora reviewed Royco (Royco Day) on 7 Aug 2026: 26 findings, 0 critical; 20 marked fixed, 6 acknowledged.
Findings28
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 10 |
| Low | 0 | 5 | 9 |
HighOne-wei bootstrap rate lets an attacker steal the first ST liquidity depositFixed
The report gives no description here.
MediumAttacker can trigger Balancer round-trip fee on EP multi-asset redemptionsFixed
The report gives no description here.
MediumEntryPoint mixes post-sync NAV with stale tranche supplyFixed
The report gives no description here.
MediumFull asset recovery does not make JT wholeFixed
The report gives no description here.
MediumIndefinitely executable requests still allow oracle update front-runningFixed
The report gives no description here.
MediumLPT deposit references mix pre-sync BPT value with post-sync accountingFixed
The report gives no description here.
MediumLT redemption yield forfeiture ignores idle liquidity-premium valueFixed
The report gives no description here.
MediumMakina share-price oracle reports fresh Chainlink timestamps for stale cached AUMFixed
The report gives no description here.
MediumMinimum coverage updates can create unearned liquidation bonusesFixed
The report gives no description here.
MediumPermissionless dust initialization can grief the Balancer liquidity venueFixed
The report gives no description here.
Show 10 more
MediumPost-operation reinvestment misprices idle liquidity-premium sharesFixed
The report gives no description here.
LowBalancer exit fee after hook-triggered reinvestmentFixed
The report gives no description here.
LowChainlink updates can mask stale ERC4626 share pricesFixed
The report gives no description here.
LowDeprecated answeredInRound check limits oracle compatibilityFixed
The report gives no description here.
LowExecutor controls the LPT redemption asset compositionFixed
The report gives no description here.
LowIdle CDO composite prices cannot enforce source-specific staleness limitsFixed
The report gives no description here.
LowIdleCDOTranchePriceOracle ignores the Chainlink feed timestampFixed
The report gives no description here.
LowSync cadence changes impermanent-loss recovery priorityFixed
The report gives no description here.
LowThe liquidation threshold cannot be updated after the junior buffer is exhaustedFixed
The report gives no description here.
LowWhitelisted shareholders can bypass EntryPoint delays and oracle gatingFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Royco’s security record
RoycoSecurity firm
Certora29 projects reviewed · 56 reports · latest Aug 2026
See Certora’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us