opus security review
Audit · firm’s term: security review
Cairo Security Clan reviewed Opus (opus security review) on 14 Feb 2025: 5 findings, 1 critical; 4 marked fixed, 1 open.
Trustblock does not review code.
Findings5
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 1 | 0 | 3 |
Criticaldirect call to on_flash_loan allows asset theftFixed
The lever contract allows users to adjust their leverage on a trove id through functions up or down. However, the on_flash_loan function lacks caller address checks, allowing any address to call it directly and bypass trove ownership checks. An attacker can manipulate arguments to convert any user's collateral into yin and transfer it to an arbitrary address without ownership validation.
Lowlever up can forge a full debt amount while receiving less collateralFixed
The report gives no description here.
Lowre-use of existing role for other purposeFixed
The report gives no description here.
Lowunused importFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (17)
- compose/src/lever/contracts/lever.cairo
- contracts/src/external/pragma_v2.cairo
- contracts/src/utils/ekubo_oracle_adapter.cairo
- contracts/src/core/receptor.cairo
- contracts/src/external/ekubo.cairo
- contracts/src/utils/math.cairo
- compose/src/stabilizer/math.cairo
- compose/src/lever/interfaces/lever.cairo
- compose/src/stabilizer/contracts/stabilizer.cairo
- compose/src/stabilizer/constants.cairo
- contracts/src/core/transmuter_v2.cairo
- compose/src/lever/types.cairo
- compose/src/stabilizer/interfaces/stabilizer.cairo
- compose/src/stabilizer/types.cairo
- compose/src/interfaces/erc20.cairo
- compose/src/lever/constants.cairo
- contracts/src/core/seer_v2.cairo
Part of Opus’s security record
OpusSecurity firm
Cairo Security Clan13 projects reviewed · 21 reports · latest Sep 2025
See Cairo Security Clan’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us