Concrete security record
As of 21 Oct 2026, Concrete has 1 audit report on Trustblock, by Zellic, dated 19 Jun 2025. That report lists no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Concrete security assessment | Security firm: Zellic | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings16
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 6 |
| Low | 0 | 2 | 6 |
HighIncorrect performance-fee calculation can lead to a denial-of-service conditionConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportHighUnhandled code path in WithdrawalQueueHelper._withdrawStrategyFunds could result in users receiving less assets than they are entitled toConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect L2 sequencer uptime feed integrationConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportMediumIncorrect swap logic in _protocolWithdrawConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportMediumPotential underflow in MorphoVaultStrategy._protocolWithdraw could lead to withdrawal failureConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportMediumThe feesUpdatedAt state variable is used before initializationConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportMediumThe protectStrategy state variable is not updated during emergencyRemoveStrategy callConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportMediumUnclaimed withdrawal requests may be incorrectly finalizedConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportLowInconsistent handling of infinite allowance in _withdrawConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportLowIncorrect rounding direction in previewMintConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportShow 4 more
LowIncorrect transfer amount in the function rescueFundsConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportLowLack of support for the 0.01% fee tier for swaps in MorphoVaultStrategyConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportLowThe function redeem lacks dust-amount checkConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportLowThe VaultManager contract lacks the code to call the function emergencyRemoveStrategyConcrete security assessment · Zellic · 19 Jun 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="concrete"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us