Securitize EVM Async Vault Audit Report
Cyfrin reviewed Securitize (Securitize EVM Async Vault Audit Report) on 20 Aug 2026: 13 findings, 0 critical; 10 marked fixed, 2 acknowledged, 1 open.
Report hosted on GitHub.
Trustblock does not review code.
Findings13
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 2 | 9 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalAsyncFundVault::initialize accepts non-contract NAV providersAcknowledged
The report gives no description here.
GasCache each reused generation mapping entry as a storage referenceAcknowledged
The report gives no description here.
GasUse the already-snapshotted list length while compacting claim listsAcknowledged
The report gives no description here.
InformationalAsyncFundVault::redeem permits vault-self claim receiversFixed
The report gives no description here.
GasCache request balances that are checked before an additive updateFixed
The report gives no description here.
GasPack the tolerance with the cached token decimal fieldsFixed
The report gives no description here.
InformationalPartial redemption claims require administrative recovery if the controller loses DS Token eligibilityFixed
The report gives no description here.
InformationalSelf reassignment temporarily hides claims from aggregate indexes until administrator repairFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Securitize’s security record
SecuritizeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us