Securitize DSToken Rebasing Audit Report
Cyfrin reviewed Securitize (Securitize DSToken Rebasing Audit Report) on 10 Oct 2025: 33 findings, 1 critical; 23 marked fixed, 10 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings33
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 0 |
| Medium | 0 | 4 | 5 |
| Low | 0 | 6 | 17 |
CriticalInvestors can steal tokens from other investors since StandardToken::transferFrom never checks spending approvalsFixed
The report gives no description here.
MediumChanging investor country to the same country inflates investor count erroneously triggering max investor errorsFixed
The report gives no description here.
MediumCountry updates is not reducing from the storage the prev countryFixed
The report gives no description here.
MediumIncorrect EIP-712 TXTYPE_HASH in SecuritizeSwapFixed
The report gives no description here.
MediumInvestors transferring all their balances among their wallets or self-transferring on the same wallet causes to incorrectly decrement the investor counters causing DoS for other investors transfersFixed
The report gives no description here.
MediumNo way to revert setInvestorLiquidateOnlyFixed
The report gives no description here.
LowAsymmetry enforcement between TokenIssuer::registerInvestor, WalletRegistrar::registerWallet and SecuritizeSwap::_registerNewInvestorFixed
The report gives no description here.
LowBurn and seize functions can be DoS when investor has several wallets that they controlFixed
The report gives no description here.
LowComplianceServiceRegulated::preIssuanceCheck allows issuance to non-accredited investors when forceAccredited or forceAccreditedUS is set, and allows issuance below regional minimum thresholds, violatFixed
The report gives no description here.
LowInvestor can prevent themselves from being removed by making removeInvestor revertFixed
The report gives no description here.
Show 10 more
LowMalicious investor can register wallets that belong to other investorsFixed
The report gives no description here.
LowMissing checkWalletsForList in issueTokensWithNoComplianceFixed
The report gives no description here.
LowMulticallProxy::_callTarget doesn’t check if target has codeFixed
The report gives no description here.
LowMultiplication could overflow in RebasingLibrary for tokens with greater than 18 decimalsFixed
The report gives no description here.
LowNo deadline for user signaturesFixed
The report gives no description here.
LowPlatform Wallet not exception for Maximum Holdings Per Investor LimitsFixed
The report gives no description here.
LowProtocol will leak value to users due to rounding in SecuritizeSwap::buyFixed
The report gives no description here.
LowRegistryService::addWallet should revert if the wallet being added has positive balance of DSTokenFixed
The report gives no description here.
LowResolve inconsistency between DSToken::checkWalletsForList and RegistryService::removeWalletFixed
The report gives no description here.
LowSecuritizeSwap::executeStableCoinTransfer should use SafeERC20 approval and transfer functions instead of standard IERC20 functionsFixed
The report gives no description here.
Show 3 more
LowTransferring all the investor balance from a non-us investor to a new us investor allows to bypass the usInvestorLimitFixed
The report gives no description here.
LowTrustService::changeEntityOwner can overwrite existing _newOwner record, breaking 1-1 relationship between owners and addressesFixed
The report gives no description here.
LowTrustService::removeRole doesn’t delete already owned entities so address which lost role can still manage existing entitiesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Securitize’s security record
SecuritizeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us