infiniFi PR 233
Cantina reviewed infiniFi (infiniFi PR 233) on 11 Dec 2025: 6 findings, 0 critical; all marked fixed.
Report hosted on cantina.xyz.
Trustblock does not review code.
Findings6
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 0 | 3 |
Marked Informational by the firm. Not counted as findings.
InformationalERC7540 farm requires vault whitelistAcknowledged
The report gives no description here.
InformationalERC7540 pending requests ignore potential feesAcknowledged
The report gives no description here.
InformationalMissing cancel path for same-epoch deposit requests can strand funds when settlement is blockedAcknowledged
The report gives no description here.
InformationalMixing prior SY balance with current redeem can violate caller’s minTokenOut boundAcknowledged
The report gives no description here.
InformationalNo administrative resync for pending ERC-7540 request ids can leave the farm stuckAcknowledged
The report gives no description here.
InformationalTrack SY token lists for potential updatesAcknowledged
The report gives no description here.
InformationalUnnecessary ERC-20 approvals in deposit/redeem flowsAcknowledged
The report gives no description here.
InformationalUnprotected large withdrawals can incur high slippageAcknowledged
The report gives no description here.
InformationalvaultDeposit and redeem flows do not account for partial submissions/settlementsAcknowledged
The report gives no description here.
InformationalZero pendingRequestId calls are ambiguous across ERC-7540 implementationsAcknowledged
The report gives no description here.
Show 8 more
InformationalAdd input token allow-list checkFixed
The report gives no description here.
InformationalAllow zero-amount swaps in the PendleSYFarmFixed
The report gives no description here.
InformationalAllowance not reset to zero after approve in HopperVault pathFixed
The report gives no description here.
InformationalMinor docstring typosFixed
The report gives no description here.
InformationalPendle swap allows same-token pathFixed
The report gives no description here.
InformationalRedundant payment on deposit callFixed
The report gives no description here.
InformationalSlippage tolerance misconfigured to 1 bp instead of intended 10 bpsFixed
The report gives no description here.
InformationalUnused imports in AutoFarm and MerklRewardsClaimerFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of infiniFi’s security record
infiniFiSecurity firm
Cantina37 projects reviewed · 175 reports · latest Oct 2026
See Cantina’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us