Vesu protocol security review

Cairo Security ClanFiles named in the report

Audit · firm’s term: security review

Cairo Security Clan reviewed Vesu (Vesu protocol security review) on 31 Aug 2024: 1 finding, 0 critical; it is marked fixed.

No open critical findings
Open the reportOpen Vesu’s security record
Report stored on IPFS. Content hash bafybeiayubmvhe52u57mglx6ozeztclabtgnbmv35n23iugwkgzc422xe4

Trustblock does not review code.

Findings1

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low001
LowMissing sign check for swap amountFixed

In the increase_lever function, after a swap operation, the function swap returns a pair of values in_amount and out_amount. Due to differences between "swap exact in" and "swap exact out" operations, it is necessary to identify which amount corresponds to collateral and which to margin using the token address. The code assumes margin_amount > 0 and collateral_amount > 0 and proceeds to transfer the amounts and handle the delta accordingly. However, these assumptions are not verified before casting the amounts to i129_new. A similar issue exists in the increase_lever and decrease_lever functions when handling leverage swaps. Recommendation: Consider implementing a check to verify the sign of the amounts before casting them to i129_new.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (2)

  • contracts/src/multiply.cairo
  • contracts/src/lib.cairo

Part of Vesu’s security record

Vesu
Audits10 audits by 3 firmsLast audit Feb 2026, by Sherlock.
Critical findingsNo open critical findingsAcross 10 reports.
Open Vesu’s security record

Security firm

Cairo Security Clan

13 projects reviewed · 21 reports · latest Sep 2025

See Cairo Security Clan’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us