Syntetika CCIP-CCT Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Syntetika (Syntetika CCIP-CCT Audit Report) on 2 May 2026: 17 findings, 0 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings17
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 0 | 13 |
HighMinter::realizeLosses is dead by default: reverts on missing vault to Minter allowanceFixed
The report gives no description here.
MediumDistributor::distributeYield permissionless + no yieldAmount validation - griefing burns rate-limit slotFixed
The report gives no description here.
MediumHilToken::_update inverted waiting-period check + permissionless HilToken::requestTransfer enables single-tx force-burn of any holder’s balanceFixed
The report gives no description here.
MediumStakingVault::claimWithdraw burns surplus on post-redeem losses, double-penalizing remaining stakersFixed
The report gives no description here.
LowBlacklistableUpgradeable uses single-step OwnableUpgradeable — instant ownership transfer bypasses all owner()-gated invariantsFixed
The report gives no description here.
LowBlacklistableUpgradeable::blacklist(address(0)) bricks all mint and burn paths across HilToken and StakingVaultFixed
The report gives no description here.
LowDirect grantRole, revokeRole bypasses the 2-step role mechanism across Minter, HilToken, StakingVault, DistributorFixed
The report gives no description here.
LowEvents / event-argument inconsistencies across contractsFixed
The report gives no description here.
LowFully-vested yield becomes unvested on vesting period updateFixed
The report gives no description here.
LowHilToken admin blacklisting TokensHolder or StakingVault in its blacklist freezes every vault exit - cross-contract blacklist DoS by a single HilToken admin keyFixed
The report gives no description here.
Show 7 more
LowMinter::distributeYield missing whenNotPausedFixed
The report gives no description here.
LowMinter::mint docstring vs code: recipient is never checked against whitelistFixed
The report gives no description here.
LowMinter::ownerMint inverted waiting-period check enables single-tx unbacked mint; chained with self-whitelist drains all Minter baseAssetFixed
The report gives no description here.
LowMinter::totalDeposits accounting drifts from both reserves and synthetic supply across every privileged pathFixed
The report gives no description here.
LowMissing runtime input validation on admin setters and creator-role functionsFixed
The report gives no description here.
LowStakingVault::redeem, withdraw missing zero-output guard in no-cooldown pathFixed
The report gives no description here.
LowStakingVault::withdraw, redeem silently ignore ERC-4626 receiver and owner parameters - causes fund loss for aggregatorsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Syntetika’s security record
SyntetikaSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us