NOYA / Vault
Hacken reviewed NOYA (NOYA / Vault) on 19 Apr 2024: 46 findings, 0 critical; 36 marked fixed, 10 open.
Report hosted on hacken.io.
Trustblock does not review code.
Findings46
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 5 | 0 | 10 |
| Low | 5 | 0 | 24 |
HighonERC721Received callback is never called which leads to loss of liquidityFixed
The report gives no description here.
HighThe non-updated totalDepositedAmount causes the incorrect calculation of the profitFixed
The report gives no description here.
MediumChainlink’s latestRoundData might return stale or incorrect resultsFixed
The report gives no description here.
MediumMinting of performance fees may cause temporary shares inflationFixed
The report gives no description here.
MediumMissing access control in public functions leads to an unauthorized accessFixed
The report gives no description here.
MediumMissing call to update holding position results in miscalculated TVLFixed
The report gives no description here.
MediumPublic ERC4626 functions bypass the protocol intended ABIFixed
The report gives no description here.
MediumThe flashLoan process is not complete, since the assets are not transferred back in the receiveFlashLoan() callbackFixed
The report gives no description here.
MediumThe non-updated totalProfitCalculated causes leads to the incorrect number of fee sharesFixed
The report gives no description here.
MediumUncontrolled loop of storage interactions may lead to Denial Of ServiceFixed
The report gives no description here.
Show 10 more
MediumUnlimited allowance is set by defaultFixed
The report gives no description here.
MediumUSD decimals are incorrectly setFixed
The report gives no description here.
LowDefault compiler behavior leads to the gas increase in the for loopFixed
The report gives no description here.
LowDeposit limit check counts deposited amount twiceFixed
The report gives no description here.
LowDirect reset of the minimumHealthFactor allows to bypass the MINIMUM_HEALTH_FACTOR checkFixed
The report gives no description here.
LowHigh oracle refresh check can lead to outdated pricingFixed
The report gives no description here.
LowImproper threshold violates the requirements of multi-signature walletFixed
The report gives no description here.
LowIncorrect return valueFixed
The report gives no description here.
LowLifiImplementation contract is incompatible with non-standard ERC20 tokensFixed
The report gives no description here.
LowLoop for storage array length wastes extra GasFixed
The report gives no description here.
Show 10 more
LowMissing access control in burning allow shares supply manipulationFixed
The report gives no description here.
LowMissing argument names in functionFixed
The report gives no description here.
LowMissing checks for the zero addressFixed
The report gives no description here.
LowMissing events emitting for critical functionsFixed
The report gives no description here.
LowMissing expiration timestamp can lead to unexpected resultsFixed
The report gives no description here.
LowMissing return value check for tokens transfers may lead to unexpected behaviorFixed
The report gives no description here.
LowMissing revert statement causes the funds to be stuck in AccountingManager if the connector is not enabledFixed
The report gives no description here.
LowMissing two-step transfer of ownership introduces risksFixed
The report gives no description here.
LowMultiplication after division may result in precision lossFixed
The report gives no description here.
LowNon-standard filenameFixed
The report gives no description here.
Show 6 more
LowSub-optimal management of fees valuesFixed
The report gives no description here.
LowThe direct usage of the Aerdrome Pool's functions leads to the extra gas and creates security risksFixed
The report gives no description here.
LowThe Keepers contract is not EIP712 compliantFixed
The report gives no description here.
LowThe usage of the precompile ecrecover can lead to signature mailabilityFixed
The report gives no description here.
LowUnused return valueFixed
The report gives no description here.
LowUse of transfer instead of call to send native assetsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (48)
- contracts/interface/ITokenTransferCallBack.sol
- contracts/interface/SwapHandler/ISwapAndBridgeHandler.sol
- contracts/connectors/DolomiteConnector.sol
- contracts/helpers/valueOracle/oracles/NoyaUniswapPriceOracle.sol
- contracts/interface/valueOracle/INoyaValueOracle.sol
- contracts/interface/Accounting/IAccountingManager.sol
- contracts/accountingManager/registry.sol
- contracts/connectors/MaverickConnector.sol
- contracts/helpers/valueOracle/oracles/ChainlinkOracleConnector.sol
- contracts/connectors/PendleConnector.sol
- contracts/accountingManager/NoyaFeeReceiver.sol
- contracts/accountingManager/AccountingManager.sol
- contracts/governance/Keepers.sol
- contracts/connectors/CompoundConnector.sol
- contracts/interface/SwapHandler/ILiFi.sol
- contracts/connectors/UNIv3Connector.sol
- contracts/interface/SwapHandler/ISwapAndBridgeImplementation.sol
- contracts/connectors/BalancerConnector.sol
- contracts/helpers/valueOracle/NoyaValueOracle.sol
- contracts/governance/Watchers.sol
- contracts/governance/TimeLock.sol
- contracts/connectors/PancakeswapConnector.sol
- contracts/interface/IConnector.sol
- contracts/connectors/StargateConnector.sol
- contracts/interface/valueOracle/AggregatorV3Interface.sol
- contracts/connectors/CamelotConnector.sol
- contracts/connectors/MorphoBlueConnector.sol
- contracts/interface/IPositionRegistry.sol
- contracts/helpers/proxy/NoyaProxy.sol
- contracts/helpers/LZHelpers/LZHelperReceiver.sol
- contracts/connectors/LidoConnector.sol
- contracts/helpers/SwapHandler/Implementaions/LifiImplementation.sol
- contracts/helpers/SwapHandler/GenericSwapAndBridgeHandler.sol
- contracts/connectors/SiloConnector.sol
- contracts/connectors/AaveConnector.sol
- contracts/helpers/OmniChainHandler/OmnichainManagerNormalChain.sol
- contracts/connectors/FraxConnector.sol
- contracts/connectors/CurveConnector.sol
- contracts/connectors/PrismaConnector.sol
- contracts/governance/NoyaGovernanceBase.sol
- contracts/helpers/TVLHelper.sol
- contracts/connectors/AerodromeConnector.sol
- contracts/connectors/BalancerFlashLoan.sol
- contracts/accountingManager/BalancerFlashLoan.sol
- contracts/helpers/OmniChainHandler/OmnichainLogic.sol
- contracts/helpers/BaseConnector.sol
- contracts/helpers/LZHelpers/LZHelperSender.sol
- contracts/helpers/OmniChainHandler/OmnichainManagerBaseChain.sol
Part of NOYA’s security record
NOYASecurity firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us