Syntetika CCIP-CCT Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed Syntetika (Syntetika CCIP-CCT Audit Report) on 2 May 2026: 17 findings, 0 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings17
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 0 | 13 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalBlacklistableUpgradeable::__Blacklistable_init callable publicly during initializationFixed
The report gives no description here.
GasCache repeated storage reads on success path across multiple settersFixed
The report gives no description here.
InformationalCosmetic code cleanups: typo, unused imports, inconsistent types and wrong error nameFixed
The report gives no description here.
InformationalCUSTODIAN_ROLE is granted/revoked but never gates any functionFixed
The report gives no description here.
InformationalDistributor::rescueERC20 uses string error messages inconsistent with project style and ignores transfer return valueFixed
The report gives no description here.
InformationalDocumentation mismatches: NatSpec, docstrings and comments disagree with codeFixed
The report gives no description here.
InformationalHilToken::_update and StakingVault::_update check blacklist status of address(0)Fixed
The report gives no description here.
InformationalInconsistent access-control patterns: mixed Ownable/AccessControl and mixed internal/external role revocationFixed
The report gives no description here.
InformationalMissing NatSpec on public-facing functions with non-obvious behaviourFixed
The report gives no description here.
InformationalMissing zero-address and zero-amount input validation across constructors, initializers and settersFixed
The report gives no description here.
Show 9 more
InformationalSolidity compiler version and toolchain configuration drift across the repoFixed
The report gives no description here.
InformationalStakingVault::_deposit with minAssetsAmount > DEAD_SHARES bricks vault seedingFixed
The report gives no description here.
InformationalStakingVault::_withdraw last-user branch reverts with ERC20InvalidReceiver when owner is renounced to zero - DoS of last-user exit during vesting windowFixed
The report gives no description here.
InformationalStakingVault::_withdraw resets $.lastDistributionTimestamp to 0Fixed
The report gives no description here.
InformationalStakingVault::setDistributor and Minter::setDistributor are independent - rotating one without the other silently bricks the yield pipelineFixed
The report gives no description here.
InformationalStakingVault::setEarlyExitFeeRecipient defaults to address(this) and permits self-target - fees silently boost share priceFixed
The report gives no description here.
InformationalTokensHolder::withdraw + Distributor::rescueERC20 use raw transfer without SafeERC20Fixed
The report gives no description here.
InformationalTokensHolder::withdraw discards transfer return value and missing eventFixed
The report gives no description here.
GasUse calldata instead of memory for external function string parametersFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Syntetika’s security record
SyntetikaSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us