Sablier Bob / Escrow Audit Report

CyfrinCode version: not recorded (see the report)

Audit · firm’s term: audit report

Cyfrin reviewed Sablier (Sablier Bob / Escrow Audit Report) on 25 Mar 2026: 16 findings, 1 critical; 9 marked fixed, 7 acknowledged.

1 critical finding, fixed
Open the reportOpen Sablier’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings16

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical001
High001
Medium013
Low064
MediumCustom comptroller fees are ignored in SablierBob::redeemAcknowledged

The report gives no description here.

LowDust WETH permanently stuck in SablierBob after adapter vault redemptionsAcknowledged

The report gives no description here.

LowExcess ETH not refunded in non-adapter vault redemptionAcknowledged

The report gives no description here.

LowFee calculations round in favor of the user instead of the protocolAcknowledged

The report gives no description here.

LowSablierBob::enter can be temporarily bricked for adapter vaults when STETH is pausedAcknowledged

The report gives no description here.

LowSablierEscrow buyers and sellers can’t set max fee slippageAcknowledged

The report gives no description here.

LowSablierEscrow::fillOrder lacks deadline parameter for buyer protection, same with swaps in SablierLidoAdapter::_wstETHToWethAcknowledged

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Sablier’s security record

Sablier
Audits2 audits by 2 firmsLast audit Mar 2026, by Cyfrin.
Critical findingsNo open critical findingsAcross the 2 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it.
Open Sablier’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us