Beefy security record
As of 21 Oct 2026, Beefy has 1 audit report on Trustblock, by Cyfrin, dated 6 Apr 2024. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Beefy Concentrated Liquidity Strategy Audit | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
Findings16
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 1 | 0 |
| Medium | 0 | 2 | 2 |
| Low | 0 | 1 | 9 |
CriticalAttacker can drain protocol tokens by sandwich attacking owner call to setPositionWidth and unpause to force redeployment of Beefy’s liquidity into an unfavorable rangeBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportMediumNative tokens permanently stuck in StrategyPassiveManagerUniswap contract due to rounding in _chargeFeesBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportMediumStrategyPassiveManagerUniswap gives ERC20 token allowances to unirouter but doesn’t remove allowances when unirouter is updatedBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportLow_onlyCalmPeriods does not consider MIN/MAX ticks, which can DOS deposit, withdraw and harvest in edge casesBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportLowDeposit can return zero shares when user deposits a positive amount of tokensBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportLowMissing storage gap in StratFeeManagerInitializable can lead to upgrade storage slot collisionBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportLowOwner of StrategyPassiveManagerUniswap can rug-pull users’ deposited tokens by manipulating onlyCalmPeriods parametersBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportLowSome tokens will be stuck in the protocol foreverBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportLowStrategyPassiveManagerUniswap::price will revert due to overflow for large but valid sqrtPriceX96Beefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportLowStrategyPassiveManagerUniswap::withdraw should call _setTicks before calling _addLiquidityBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportShow 2 more
LowUpgradeable contracts don’t call disableInitializersBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportLowWithdraw can return zero tokens while burning a positive amount of sharesBeefy Concentrated Liquidity Strategy Audit · Cyfrin · 6 Apr 2024Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="beefy"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us