Zaros Finance Audit Report
Cyfrin reviewed Zaros (Zaros Finance Audit Report) on 13 Jul 2024: 32 findings, 5 critical; 28 marked fixed, 4 acknowledged.
Findings32
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 5 |
| High | 0 | 0 | 3 |
| Medium | 0 | 2 | 10 |
| Low | 0 | 2 | 10 |
Marked Informational or Gas by the firm. Not counted as findings.
InformationalLiquidation reverts if collateral price feed returns 0Acknowledged
The report gives no description here.
GasMultiple levels of abstraction result in the same values being repeatedly read from storage over and over againAcknowledged
The report gives no description here.
GasCache memory array length if expected size of array is >= 3Fixed
The report gives no description here.
GasCache result of indexPriceX18.intoSD59x18 in PerpMarket::getMarkPriceFixed
The report gives no description here.
GasCache sd59x18(sizeDelta) in OrderBranch::simulateTrade to prevent wrapping the same value 3 additional timesFixed
The report gives no description here.
GasCache self.skew in PerpMarket::checkOpenInterestLimits to avoid reading same value from storage twiceFixed
The report gives no description here.
GasDon’t initialize variables to default valuesFixed
The report gives no description here.
GasDon’t read position.size from storage after position has been reset in LiquidationBranch::liquidateAccountsFixed
The report gives no description here.
GasFail fast in LiquidationBranch::checkLiquidatableAccountsFixed
The report gives no description here.
GasFail fast in LiquidationBranch::liquidateAccountsFixed
The report gives no description here.
Show 10 more
GasFail fast in OrderBranch::createMarketOrderFixed
The report gives no description here.
GasFail fast in PerpMarket::checkOpenInterestLimitsFixed
The report gives no description here.
InformationalGlobalConfigurationBranch::updateSettlementConfiguration can be called for a non-existent marketIdFixed
The report gives no description here.
GasIn PerpMarket::checkOpenInterestLimits only calculate isReducingSkew if shouldCheckMaxSkew == trueFixed
The report gives no description here.
InformationalInconsistent validation while creating/updating a perp marketFixed
The report gives no description here.
GasLiquidationKeeper::checkUpkeep should only continue processing if lower bounds are smaller than upper boundsFixed
The report gives no description here.
GasMove immutable branch check outside for loop in RootUpgrade::removeBranchFixed
The report gives no description here.
GasNeedless addition in TradingAccount::withdrawMarginUsdFixed
The report gives no description here.
GasOptimize away call to EnumerableSet::contains in GlobalConfiguration::configureCollateralLiquidationPriorityFixed
The report gives no description here.
GasOptimize away liquidatedCollateralUsdX18 variable from LiquidationBranch::liquidateAccountsFixed
The report gives no description here.
Show 10 more
GasRemove boolean condition that will always be false from LiquidationBranch::liquidateAccountsFixed
The report gives no description here.
GasRemove redundant uint256 cast in PerpMarket::getMarkPriceFixed
The report gives no description here.
GasRemove redundant unary call from TradingAccount::getAccountMarginRequirementUsdAndUnrealizedPnlUsdFixed
The report gives no description here.
GasReturn fast in TradingAccountBranch::getAccountLeverage when margin balance is zeroFixed
The report gives no description here.
InformationalReturn more suitable error type when params.initialMarginRateX18 <= params.maintenanceMarginRateX18Fixed
The report gives no description here.
InformationalStandardize accountId data typeFixed
The report gives no description here.
InformationalThe LogConfigureMarginCollateral event doesn’t emit loanToValueFixed
The report gives no description here.
InformationalUnused variablesFixed
The report gives no description here.
GasUse constants for sd59x18(0) and ud60x18(0)Fixed
The report gives no description here.
GasUse input amount in TradingAccountBranch::withdrawMargin when calling safeTransferFixed
The report gives no description here.
Show 1 more
GasUse named return variables to save 9 gas per return variableFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Zaros’s security record
ZarosSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us