Zaros Finance Audit Report
Cyfrin reviewed Zaros (Zaros Finance Audit Report) on 13 Jul 2024: 32 findings, 5 critical; 28 marked fixed, 4 acknowledged.
Findings32
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 5 |
| High | 0 | 0 | 3 |
| Medium | 0 | 2 | 10 |
| Low | 0 | 2 | 10 |
CriticalAttacker can burn USDToken from any userFixed
The report gives no description here.
CriticalAttacker can perform a risk-free trade to mint free USDz tokens by opening then quickly closing positions for markets using negative makerFeeFixed
The report gives no description here.
CriticalAttacker can steal user deposited collateral tokens by updating account nft token to a custom attack contract addressFixed
The report gives no description here.
CriticalImpossible to liquidate accounts with multiple active markets as LiquidationBranch::liquidateAccounts reverts due to corruption of ordering in TradingAccount::activeMarketsIdsFixed
The report gives no description here.
CriticalTradingAccount::withdrawMarginUsd transfers an incorrectly larger amount of margin collateral for tokens with less than 18 decimalsFixed
The report gives no description here.
HighGlobalConfiguration::removeCollateralFromLiquidationPriority corrupts the collateral priority order resulting in incorrect order of collateral liquidationFixed
The report gives no description here.
HighTrader can’t reduce open position size when under initial margin requirement but over maintenance margin requirementFixed
The report gives no description here.
HighTradingAccountBranch::depositMargin attempts to transfer greater amount than user deposited for tokens with less than 18 decimalsFixed
The report gives no description here.
MediumAnyone can cancel traders’ market orders due to missing access control in OrderBranch::cancelMarketOrderFixed
The report gives no description here.
MediumChainlinkUtil::getPrice doesn’t check for stale priceFixed
The report gives no description here.
Show 10 more
MediumChainlinkUtil::getPrice doesn’t check if L2 Sequencer is downFixed
The report gives no description here.
MediumChainlinkUtil::getPrice will use incorrect price when underlying aggregator reaches minAnswerFixed
The report gives no description here.
MediumKeeper fills market order using incorrect old marketId but newly updated position size when trader updates open order immediately before keeper processes original orderFixed
The report gives no description here.
MediumLiquidation leaves traders with unhealthier and riskier collateral basket, making them more likely to be liquidated in future tradesFixed
The report gives no description here.
MediumProtocol operator can disable market with open positions, making it impossible for traders to close their open positions but still subjecting them to potential liquidationFixed
The report gives no description here.
MediumProtocol operator can disable settlement for market with open positions, making it impossible for traders to close their open positions but still subjecting them to potential liquidationFixed
The report gives no description here.
MediumSettlementBranch::_fillOrder doesn’t pay order and settlement fees if PNL is positiveFixed
The report gives no description here.
MediumUsers can easily bypass collateral depositCap limit using multiple deposits under the limitFixed
The report gives no description here.
LowGracefully handle state where perp market maxOpenInterest is updated to be smaller than the current open interestFixed
The report gives no description here.
LowMarketOrder minimum lifetime can be easily bypassedFixed
The report gives no description here.
Show 8 more
LowOrderBranch::getMarginRequirementForTrade doesn’t include order and settlement fees when calculating margin requirementsFixed
The report gives no description here.
LowPerpMarket::getOrderFeeUsd incorrectly charges makerFee when skew is zero and trade is buy orderFixed
The report gives no description here.
LowPerpMarket::getOrderFeeUsd rewards traders who flip the skew with makerFee for the full tradeFixed
The report gives no description here.
LowRemove max open interest check when liquidating in Liquidation- Branch::liquidateAccountsFixed
The report gives no description here.
LowSettlementBranch::_fillOrder can revert for positions with negative PNL in markets with negative maker/taker feesFixed
The report gives no description here.
LowSettlementBranch::_fillOrder reverts if absolute value of PNL is smaller than sum of order and settlement feesFixed
The report gives no description here.
LowTraders can’t limit slippage and expiration time when creating market ordersFixed
The report gives no description here.
LowTradingAccount::deductAccountMargin can incorrectly add the same values multiple times to output parameter marginDeductedUsdX18Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Zaros’s security record
ZarosSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us