Dust
CredShields reviewed Dust on 11 Sep 2026: 10 findings, 0 critical; all marked fixed.
Findings12
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 4 |
| Low | 0 | 0 | 5 |
HighDustRouter keeps the unspent half of a partial fill, and any unprivileged address can take itFixed
The report gives no description here.
MediumA user cannot revoke the sweeper's standing authority over their accrued stable, and the only price bound is the keeper's own calldataFixed
The report gives no description here.
MediumbuyLeg credits the pool-reported token output instead of the vault's realized balance deltaFixed
The report gives no description here.
MediumSweep fee is charged on the gross amount and re-charged on returned leftover, letting the effective fee exceed the immutable MAX_FEE_BPS capFixed
The report gives no description here.
Mediumsweep pins only the basket composition: the accrued amount, execution venue, fee basis, treasury and minimum are all mutable between quote and executionFixed
The report gives no description here.
LowbuyLeg never bounds spent against the leg's slice, so a non-canonical listed pool can drain a swept user's other-leg fundsFixed
The report gives no description here.
LowDustCapture enforces its TWAP bound per callback rather than per swap, and credits the vault from the pool's self-reported deltaFixed
The report gives no description here.
LowOutdated and unpinned compiler pragmaFixed
The report gives no description here.
LowSweep settlement transfers are not leg-isolated, so a frozen treasury or sweeper bricks sweeping for all usersFixed
The report gives no description here.
LowUse safeTransfer / safeTransferFrom instead of transfer / transferFromFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Dust’s security record
DustSecurity firm
CredShields45 projects reviewed · 58 reports · latest Oct 2026
See CredShields’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us