Strata security record

Ethereumstrata.money

As of 29 Oct 2026, Strata has 7 audit reports by 3 security firms on Trustblock; the latest is by Cyfrin, dated 23 Jan 2026. Those reports list no open critical findings.

Critical findings
No open critical findings
Across the 7 reports, 3 critical findings were reported. Each is marked fixed by the firm that reported it. See the findings
Open the latest report
Your label, live
Get the label for your site

Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.

Audits7

Newest first

AuditSecurity firmDateScopeCritical findingsReport
Strata Shares Cooldown Audit ReportSecurity firm: CyfrinDate: Scope: Not recorded (see the report)No open critical findingsOpen · GitHub
Strata - Update to TranchesSecurity firm: QuantstampDate: Scope: Repository at commit ef6dbfdNo open critical findingsOpen · certificate.quantstamp.com
Strata TranchesSecurity firm: QuantstampDate: Scope: Not recorded (see the report)No open critical findingsOpen · certificate.quantstamp.com
Strata Tranches ReportSecurity firm: Guardian AuditsDate: Scope: Not recorded (see the report)1 critical finding, fixedOpen · GitHub
Strata Tranches Audit ReportSecurity firm: CyfrinDate: Scope: Not recorded (see the report)1 critical finding, fixedOpen · GitHub
Strata PreDeposit VaultsSecurity firm: QuantstampDate: Scope: Files named in the reportNo open critical findingsOpen · certificate.quantstamp.com
Strata PreDeposit Audit ReportSecurity firm: CyfrinDate: Scope: Not recorded (see the report)1 critical finding, fixedOpen · GitHub

Findings76

Statuses are the security firm’s own, from each report.

SeverityOpenAcknowledgedFixed
Critical003
High008
Medium0030
Low2033
LowFinal Deposit Before Shortfall-Scenario Could Gain Disproportionately Large Share in JRTStrata Tranches · Quantstamp · 28 Oct 2025Open

When depositing or withdrawaing from either the junior or senior vaults, the `shortfallPauser()` function is called. This function pauses deposits into both tranches in case that the share price in the JRT vault falls below a specified value. This can occur when debt obligations of the junior tranche as paid into the senior tranche in scenarios where the senior tranches promised yield could not be met. As part of a deposit, first, the accounting and debt is settled via `updateAccounting()`, followed by the actual deposit flow and then the mentioned shortfall-pause-mechanic. Notably, a triggered shortfall does not revert the transaction, but simply disables future deposits and emits an event. This ordering however means that a potential final large deposit, solidifying a shortfall, into the JRT could possibly mint shares far below the configured `jrtShortfallPausePrice`, which is intended to be the minimum price of the tranche. Such a depositor could possibly mint junior tranche tokens at a significant discount and see the value increase back to normal as future yield is generated by the protocol.

Open the report
LowBetter Handling of Potentially Reverting Registered VaultsStrata PreDeposit Vaults · Quantstamp · 7 Jul 2025Open

A reverting registered vault does impose significant DoS to the system. The `MetaVault._redeemRequiredBaseAssets()` function does contain try-catch logic for withdrawal-attempt, but such logic is not integrated into other functions interacting with the registered vaults. Attempts to transition the vault into the yield phase would fail, as such a vault would also cause a revert in the `_redeemAndClearMetaVaults()` function. However, the vault could also not be removed, as calls to `removeVault()` would also revert, due to the external call to the registered vault's `redeem()` function in `_removeVaultAndRedeemInner()` is also not within a try-catch block.

Open the report

Contracts

No deployed address is recorded for these audits.

The reports name a repository or files. Open a report to see its scope.

The repositories and files the reports name

Show this on your site

Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.

Content

Facts

Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.

Fixed as
Language

Style

Layout
Theme
Accent
Corners

Format

Size
Date
Embed as
HTML
<head>
<script src="https://widget.trustblock.run/project-widget.min.js" defer></script>
</head>
<body>
<div
data-tb-project-widget
data-tb-project-slug="strata"
></div>
</body>

Paste the code where the label should appear. It uses no API credit and updates by itself.

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us