Blueberry security review

Pashov Audit Group29 Mar 2025Code version: not recorded (see the report)

Audit · firm’s term: security review

Pashov Audit Group reviewed Blueberry (Blueberry security review) on 29 Mar 2025: 8 findings, 1 critical; 6 marked fixed, 2 acknowledged.

1 critical finding, fixed

Open the report Open Blueberry’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	1
High	0	0	3
Medium	0	0	0
Low	0	2	2

CriticalIncorrect fee due to double subtracting requestSum.assetsFixed

The report gives no description here.

HighDonated tokens are never deposited into vaultsFixed

The report gives no description here.

HighFlawed withdrawal logic when caller differs from share ownerFixed

The report gives no description here.

HighPrecision loss in _withdrawFromL1Vault() can cause asset transfer revertsFixed

The report gives no description here.

LowIncorrect address check in constructor()Fixed

The report gives no description here.

LowIncorrect max withdrawable assets amount causes unexpected revertFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Blueberry’s security record

Blueberry

Audits4 audits by 2 firmsLast audit May 2025, by Pashov Audit Group.

Critical findingsNo open critical findingsAcross the 4 reports, 1 critical finding was reported. It is marked fixed by the firm that reported it.

Open Blueberry’s security record

Security firm

Pashov Audit Group

30 projects reviewed · 53 reports · latest Jul 2026

See Pashov Audit Group’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.