Blueberry security record
As of 21 Oct 2026, Blueberry has 4 audit reports by 2 security firms on Trustblock; the latest is by Pashov Audit Group, dated 19 May 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Blueberry security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Blueberry security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Blueberry security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Composable Corp / Lending Platform | Security firm: Hacken | Date: | Scope: Files named in the report | No open critical findings | Open · hacken.io |
Findings65
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 1 |
| High | 0 | 0 | 11 |
| Medium | 2 | 0 | 14 |
| Low | 3 | 3 | 31 |
CriticalIncorrect fee due to double subtracting requestSum.assetsBlueberry security review · Pashov Audit Group · 29 Mar 2025Fixed
The report gives no description here.
Open the reportHighEscrow.tvl() does not add in-flight USDC amountBlueberry security review · Pashov Audit Group · 19 May 2025Fixed
The report gives no description here.
Open the reportHighDonated tokens are never deposited into vaultsBlueberry security review · Pashov Audit Group · 29 Mar 2025Fixed
The report gives no description here.
Open the reportHighFlawed withdrawal logic when caller differs from share ownerBlueberry security review · Pashov Audit Group · 29 Mar 2025Fixed
The report gives no description here.
Open the reportHighPrecision loss in _withdrawFromL1Vault() can cause asset transfer revertsBlueberry security review · Pashov Audit Group · 29 Mar 2025Fixed
The report gives no description here.
Open the reportHighIncorrect erc20 transfer implementation between evm and core chainsBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportHighMalicious users may block other withdrawalsBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportHighUnapproved requests are not deducted from total assetsBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportHighUser can drain escrow via approved withdrawalsBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportHighWithdraw check can be bypassedBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportShow 10 more
HighInvalid Calculations — Collateral Value CorruptionComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportHighUpgradeability Issues — Missing Storage GapComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportMediumIncorrect rounding in mint()Blueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportMediumProtocol fee rounding can be weaponized for minimal earningsBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportMediumsetManagementFeeBps() fails to update fee stateBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportMediumWrong fee share calculations in _takeFee()Blueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportMediumBest Practice Violation — Denial of ServiceComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportMediumBest Practice Violation — Unpausable OraclesComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportMediumContradiction — Requirement ViolationComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportMediumContradiction — Unchecked RelymentComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportShow 10 more
MediumContradiction — Unchecked RelymentComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportMediumContradiction — Unchecked RelymentComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportMediumContradiction — Unchecked RelymentComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportMediumContradiction — Unvalidated TWAP PeriodComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportMediumContradiction — Unvalidated TWAP PeriodComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportMediumContradiction — Zero Price AllowedComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowAsset removal ignores in-flight bridge amountsBlueberry security review · Pashov Audit Group · 19 May 2025Fixed
The report gives no description here.
Open the reportLowDead code in bridgeToL1Blueberry security review · Pashov Audit Group · 19 May 2025Fixed
The report gives no description here.
Open the reportLowFee calculation includes historical balances of new assetsBlueberry security review · Pashov Audit Group · 19 May 2025Fixed
The report gives no description here.
Open the reportLowmaxRedeemable underestimates shares due to uncollected feesBlueberry security review · Pashov Audit Group · 19 May 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowmaxRedeemable uses incorrect rounding methodBlueberry security review · Pashov Audit Group · 19 May 2025Fixed
The report gives no description here.
Open the reportLowminDepositValue uses inadequate bit size for large depositsBlueberry security review · Pashov Audit Group · 19 May 2025Fixed
The report gives no description here.
Open the reportLowRemoving unsupported asset might wrongly remove USDCBlueberry security review · Pashov Audit Group · 19 May 2025Fixed
The report gives no description here.
Open the reportLowIncorrect address check in constructor()Blueberry security review · Pashov Audit Group · 29 Mar 2025Fixed
The report gives no description here.
Open the reportLowIncorrect max withdrawable assets amount causes unexpected revertBlueberry security review · Pashov Audit Group · 29 Mar 2025Fixed
The report gives no description here.
Open the reportLowAdd checks for zero returned sharesBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportLowCurrentblockdeposits() may return an incorrect valueBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportLowmaxwithdraw() ignores pending redemptionsBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportLowPreview functions fail with supply=0Blueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportLowProtocol may charge more fees than expectedBlueberry security review · Pashov Audit Group · 15 Mar 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowBest Practice ViolationComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowBest Practice ViolationComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowCode DuplicationComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowDefault VisibilityComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowDuplicated Hardcoded ValuesComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowLegacy CheckComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowMisleading NamesComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowMissing Implementation InitializationComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowMissing Zero Address ValidationComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowMixing Functionality PurposesComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportShow 7 more
LowMixing WhitelistsComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowParameters Order DependenceComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowRedundant ActionsComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowRedundant ImportsComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowRedundant StatementsComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowRedundant Using StatementComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportLowUnscalable FunctionalityComposable Corp / Lending Platform · Hacken · 26 Apr 2023Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="blueberry-garden"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us