As of 29 Oct 2026, Strata has 7 audit reports by 3 security firms on Trustblock; the latest is by Cyfrin, dated 23 Jan 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Strata Shares Cooldown Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Strata - Update to Tranches | Security firm: Quantstamp | Date: | Scope: Repository at commit ef6dbfd | No open critical findings | Open · certificate.quantstamp.com |
| Strata Tranches | Security firm: Quantstamp | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · certificate.quantstamp.com |
| Strata Tranches Report | Security firm: Guardian Audits | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Strata Tranches Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Strata PreDeposit Vaults | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Strata PreDeposit Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 3 |
| High | 0 | 0 | 8 |
| Medium | 0 | 0 | 30 |
| Low | 2 | 0 | 33 |
When depositing or withdrawaing from either the junior or senior vaults, the `shortfallPauser()` function is called. This function pauses deposits into both tranches in case that the share price in the JRT vault falls below a specified value. This can occur when debt obligations of the junior tranche as paid into the senior tranche in scenarios where the senior tranches promised yield could not be met. As part of a deposit, first, the accounting and debt is settled via `updateAccounting()`, followed by the actual deposit flow and then the mentioned shortfall-pause-mechanic. Notably, a triggered shortfall does not revert the transaction, but simply disables future deposits and emits an event. This ordering however means that a potential final large deposit, solidifying a shortfall, into the JRT could possibly mint shares far below the configured `jrtShortfallPausePrice`, which is intended to be the minimum price of the tranche. Such a depositor could possibly mint junior tranche tokens at a significant discount and see the value increase back to normal as future yield is generated by the protocol.
Open the reportA reverting registered vault does impose significant DoS to the system. The `MetaVault._redeemRequiredBaseAssets()` function does contain try-catch logic for withdrawal-attempt, but such logic is not integrated into other functions interacting with the registered vaults. Attempts to transition the vault into the yield phase would fail, as such a vault would also cause a revert in the `_redeemAndClearMetaVaults()` function. However, the vault could also not be removed, as calls to `removeVault()` would also revert, due to the external call to the registered vault's `redeem()` function in `_removeVaultAndRedeemInner()` is also not within a try-catch block.
Open the reportThe reports name a repository or files. Open a report to see its scope.
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="strata"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us