Securitize DSToken Rebasing Audit Report
Audit · firm’s term: audit report
Part of Cyfrin’s series
Cyfrin reviewed Securitize (Securitize DSToken Rebasing Audit Report) on 10 Oct 2025: 33 findings, 1 critical; 23 marked fixed, 10 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings33
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 0 |
| Medium | 0 | 4 | 5 |
| Low | 0 | 6 | 17 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalCache compliance service and compliance configuration service for much cleaner code in ComplianceServiceRegulated::completeTransferCheckAcknowledged
The report gives no description here.
GasCache computation results instead of repeatedly performing the same computationAcknowledged
The report gives no description here.
GasCache result of identical external calls when the result can’t changeAcknowledged
The report gives no description here.
GasCache storage to prevent identical storage readsAcknowledged
The report gives no description here.
InformationalComplianceConfigurationService::getWorldWideForceFullTransfer is not applied to US investorsAcknowledged
The report gives no description here.
InformationalComplianceServiceRegulated::getServices should use constants from ComplianceServiceLibrary when setting array indexesAcknowledged
The report gives no description here.
InformationalFeature flags are not being used in the TokenLibraryAcknowledged
The report gives no description here.
GasIn Solidity don’t initialize to default valuesAcknowledged
The report gives no description here.
InformationalInvestorLockManager::createLockForInvestor, removeLockRecord- ForInvestor should revert for invalid investor idAcknowledged
The report gives no description here.
GasMore efficient way of comparing two strings for equality in CommonUtils::isEqualStringAcknowledged
The report gives no description here.
Show 10 more
InformationalNot mechanism to automatically cleanup locks that are already unlock-able on LockManagersAcknowledged
The report gives no description here.
GasPerform local variable checks first prior to external calls in composite if statement conditionsAcknowledged
The report gives no description here.
InformationalPossible to escape burning of DSTokens by removing the wallet from the current investor and adding it as the wallet of another investorAcknowledged
The report gives no description here.
InformationalRefactor duplicated checks into modifiersAcknowledged
The report gives no description here.
GasRemove deprecated collision hash and proof hash from function callsAcknowledged
The report gives no description here.
GasSince attribute expiration is deprecated, remove as input parameters, don’t write it to storage and put comment explaining thisAcknowledged
The report gives no description here.
InformationalUse named constants instead of hard-coded literals for important valuesAcknowledged
The report gives no description here.
GasUse named return variables where this optimizes away a local variable definitionAcknowledged
The report gives no description here.
InformationalUsing block.number instead of block.timestamp as an expiration check to execute signatureAcknowledged
The report gives no description here.
GasCheaper not to cache calldata array lengthFixed
The report gives no description here.
Show 10 more
InformationalComplianceServiceRegulated and its parent ComplianceService- Whitelisted uses a chain of initializer modifiers when calling the initializeFixed
The report gives no description here.
GasComplianceServiceRegulated::getComplianceTransferableTokens should call IDSLockManager::getTransferableTokensForInvestorFixed
The report gives no description here.
InformationalConsider reverting in RebasingLibrary functions if rounding down to zero occursFixed
The report gives no description here.
GasDon’t perform storage reads unless necessaryFixed
The report gives no description here.
GasDon’t write to the same storage slot multiple timesFixed
The report gives no description here.
InformationalEmit missing eventsFixed
The report gives no description here.
GasFast fail without performing unnecessary storage reads or external callsFixed
The report gives no description here.
GasMore efficient way of checking for empty string in CommonUtils::isEmptyStringFixed
The report gives no description here.
InformationalNot possible to rehash DOMAIN_SEPARATOR in MultiSigWallet to update chainId if is ever requiredFixed
The report gives no description here.
GasNot possible to send native via the TransactionRelayer to the target contract when executing executeByInvestorWithBlockLimitFixed
The report gives no description here.
Show 10 more
InformationalPrefer ECDSA::tryRecover to using ecrecover directlyFixed
The report gives no description here.
InformationalPrefer explicit unsigned integer sizesFixed
The report gives no description here.
InformationalProtocol classifies retail investors based solely on whether they are qualified investors, without checking if they are accredited investorsFixed
The report gives no description here.
InformationalRefactor away duplicated code between ComplianceService::newPreTransferCheck and preTransferCheckFixed
The report gives no description here.
InformationalRemove obsolete return statements when already using named return variablesFixed
The report gives no description here.
GasRemove return value from DSToken::updateInvestorBalance as it is never checkedFixed
The report gives no description here.
GasRemove setting deprecated lastUpdatedBy in RegistryServiceFixed
The report gives no description here.
InformationalRemove useless function ComplianceServiceRegulated::adjustTransferCountsFixed
The report gives no description here.
GasReturn fast in ComplianceServiceRegulated::checkHoldUp if platform walletFixed
The report gives no description here.
InformationalSecuritizeSwap::buy should revert if stableCoinAmount is zeroFixed
The report gives no description here.
Show 5 more
InformationalTransactionRelayer and SecuritizeSwap should use CommonUtils::encodeStringFixed
The report gives no description here.
InformationalUpgradeable contracts should call _disableInitializers in constructorFixed
The report gives no description here.
GasUse calldata for read-only external inputsFixed
The report gives no description here.
InformationalUse named importsFixed
The report gives no description here.
InformationalUse named mapping parameters to explicitly note the purpose of keys and valuesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Securitize’s security record
SecuritizeSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us