Sablier Bob / Escrow Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Sablier (Sablier Bob / Escrow Audit Report) on 25 Mar 2026: 16 findings, 1 critical; 9 marked fixed, 7 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 3 |
| Low | 0 | 6 | 4 |
CriticalAdapter vault _userWstETH not cleared after redemption enables theft of other users’ fundsFixed
The report gives no description here.
HighCircular slippage protection in SablierLidoAdapter::_wstETHToWeth enables sandwich attacks on adapter vault unstakingFixed
The report gives no description here.
MediumFloor division in SablierLidoAdapter::updateStakedTokenBalance allows transferring BobVaultShares without moving wstETH backingFixed
The report gives no description here.
MediumImmutable Curve pool dependency creates long-term redemption risk for adapter vaultsFixed
The report gives no description here.
MediumUsers can bypass vault lock and withdraw at any timeFixed
The report gives no description here.
LowETH sent with adapter vault redemption is trapped in SablierBobFixed
The report gives no description here.
LowExitWithinGracePeriod event emits inaccurate amountReceived for adapter vaultsFixed
The report gives no description here.
LowfeeAmount never set when no vault adapter used in SablierBob::redeemFixed
The report gives no description here.
LowSeller minBuyAmount order parameter is not respected due to post application of trade feesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Sablier’s security record
SablierSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us