Concrete security assessment
Audit · firm’s term: security assessment
Zellic reviewed Concrete (Concrete security assessment) on 19 Jun 2025: 16 findings, 0 critical; 14 marked fixed, 2 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings16
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 6 |
| Low | 0 | 2 | 6 |
HighIncorrect performance-fee calculation can lead to a denial-of-service conditionFixed
The report gives no description here.
HighUnhandled code path in WithdrawalQueueHelper._withdrawStrategyFunds could result in users receiving less assets than they are entitled toFixed
The report gives no description here.
MediumIncorrect L2 sequencer uptime feed integrationFixed
The report gives no description here.
MediumIncorrect swap logic in _protocolWithdrawFixed
The report gives no description here.
MediumPotential underflow in MorphoVaultStrategy._protocolWithdraw could lead to withdrawal failureFixed
The report gives no description here.
MediumThe feesUpdatedAt state variable is used before initializationFixed
The report gives no description here.
MediumThe protectStrategy state variable is not updated during emergencyRemoveStrategy callFixed
The report gives no description here.
MediumUnclaimed withdrawal requests may be incorrectly finalizedFixed
The report gives no description here.
LowInconsistent handling of infinite allowance in _withdrawFixed
The report gives no description here.
LowIncorrect rounding direction in previewMintFixed
The report gives no description here.
Show 4 more
LowIncorrect transfer amount in the function rescueFundsFixed
The report gives no description here.
LowLack of support for the 0.01% fee tier for swaps in MorphoVaultStrategyFixed
The report gives no description here.
LowThe function redeem lacks dust-amount checkFixed
The report gives no description here.
LowThe VaultManager contract lacks the code to call the function emergencyRemoveStrategyFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Concrete’s security record
ConcreteSecurity firm
Zellic28 projects reviewed · 31 reports · latest Apr 2026
See Zellic’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us