Sablier Bob / Escrow Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Sablier (Sablier Bob / Escrow Audit Report) on 25 Mar 2026: 16 findings, 1 critical; 9 marked fixed, 7 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 3 |
| Low | 0 | 6 | 4 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalAdd validation in SablierBob::createOrder to disallow same address as buyer and sellerAcknowledged
The report gives no description here.
InformationalAttacker can permanently lock or drain fee-on-transfer tokens from SablierEscrowAcknowledged
The report gives no description here.
InformationalConsider adding a vault migration feature so non-adapter vault users can migrate to a vault with an adapterAcknowledged
The report gives no description here.
GasEmit event first to optimize away previous value variablesAcknowledged
The report gives no description here.
InformationalIn Solidity don’t initialize to default valuesAcknowledged
The report gives no description here.
InformationalMissing or inadequate Chainlink Oracle checks in SablierBob.solAcknowledged
The report gives no description here.
InformationalUse read-then-increment in one lineAcknowledged
The report gives no description here.
GasUse ReentrancyGuardTransient for faster nonReentrant modifiersAcknowledged
The report gives no description here.
GasUse SafeTransferLib::safeTransferETH instead of Solidity call to send ETH in SablierBob::redeemAcknowledged
The report gives no description here.
GasCache storage to prevent identical storage readsFixed
The report gives no description here.
Show 10 more
GasDon’t copy entire struct from storage to memory when only few fields requiredFixed
The report gives no description here.
InformationalEmit event SyncPriceFromOracle when price is syncedFixed
The report gives no description here.
InformationalMissing getter function for SablierBobState::isStakedInAdapterFixed
The report gives no description here.
GasQA/Gas improvements in related Sablier contractsFixed
The report gives no description here.
InformationalRemove or resolve TODOFixed
The report gives no description here.
GasRevert fast by performing input related checks prior to storage reads and external callsFixed
The report gives no description here.
GasSablierBob::_unstakeFullAmountViaAdapter should take vault.adapter as input parameterFixed
The report gives no description here.
GasSablierLidoAdapter::unstakeFullAmount should return totalWstETHFixed
The report gives no description here.
GasUse msg.sender instead of accessing comptroller state variable to save gasFixed
The report gives no description here.
GasUse named return variables where this can optimize away local variablesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Sablier’s security record
SablierSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us