YieldFi audit
Audit · firm’s term: security review
Sherlock reviewed YieldFi (YieldFi audit) on 14 Jan 2026: 17 findings, 0 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings17
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 8 |
| Low | 0 | 0 | 9 |
MediumCannot add a user to greenlist of the global vaultFixed
The report gives no description here.
MediumDecimal Mismatch in LimitsFeature Causes Deposit Limit BypassFixed
The report gives no description here.
Mediumdeposit function in Manager contract lacks slippage protectionFixed
The report gives no description here.
MediumDeposits using lagging Vested NAV (currentNav) causes dilution of existing shareholdersFixed
The report gives no description here.
MediumFlawed on-chain performance fee check in updateNav causes transaction reversionFixed
The report gives no description here.
MediumImproper L2 Sequencer Check Implementation in Chainlink Oracle AdapterFixed
The report gives no description here.
MediumIncorrect redemption amount when MIN_NAV feature is enabledFixed
The report gives no description here.
MediumL2 Sequencer Status Check Logic Inversion Leading to Denial of Service (DoS)Fixed
The report gives no description here.
LowCannot cancel a redemption with blacklisted receiverFixed
The report gives no description here.
LowChainlinkOracleAdapter Initialization Bypasses Parent Initialization MethodFixed
The report gives no description here.
Show 7 more
LowFee receiver cannot fully redeem sharesFixed
The report gives no description here.
LowGreenlist/blacklist check can be bypassed by depositing through a vaultFixed
The report gives no description here.
LowIncorrect constant percentsFixed
The report gives no description here.
LowPerformance fee guardrail calculation uses real-time total supply leading to incorrect capFixed
The report gives no description here.
LowUse of Deprecated answeredInRound CheckFixed
The report gives no description here.
LowUser KYC date can be updated to future timestampFixed
The report gives no description here.
LowVault fee guardrail bypass when feeRate = 0 or totalSupply = 0Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of YieldFi’s security record
YieldFiSecurity firm
Sherlock5 projects reviewed · 7 reports · latest Jun 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us