Strata security record
As of 30 Oct 2026, Strata has 7 audit reports by 3 security firms on Trustblock; the latest is by Cyfrin, dated 23 Jan 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits7
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Strata Shares Cooldown Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Strata - Update to Tranches | Security firm: Quantstamp | Date: | Scope: Repository at commit ef6dbfd | No open critical findings | Open · certificate.quantstamp.com |
| Strata Tranches | Security firm: Quantstamp | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · certificate.quantstamp.com |
| Strata Tranches Report | Security firm: Guardian Audits | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Strata Tranches Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Strata PreDeposit Vaults | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Strata PreDeposit Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
Findings76
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 3 |
| High | 0 | 0 | 8 |
| Medium | 0 | 0 | 30 |
| Low | 2 | 0 | 33 |
CriticalReserve Withdrawal Unit MismatchStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportCriticalWithdrawers of sUSDe always incur a loss because parameters passed from Tranche::_withdraw to CDO::withdraw are invertedStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportCriticalAn attacker can drain the entire protocol balance of sUSDe during the yield phase due to incorrect redemption accounting logic in pUSDeVault::_withdrawStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportHighJRT totalSupply Will Grow ConstantlyStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportHighJuniors Do Not Profit On LossStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportHighMEV APR Front-Run Via onAprChangedStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportHighWithdraw Griefing DoSStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportHighWithdrawals Flip Token And Base AssetsStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportHighMechanism to prevent donation attack can be gamed to cause withdrawals to revert causing assets to get stuck on the StrategyStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportHighUsers can get their withdrawal active requests DoSed by malicious usersStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportShow 10 more
HighDuring the yield phase, when using supported vaults, users can’t withdraw vault assets they are entitled toStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportMediumAPR Targets are not updated when withdrawal requests are sent to the SharesCooldown to reflect the change on NAVs caused by the charged fees for the withdrawalStrata Shares Cooldown Audit Report · Cyfrin · 23 Jan 2026Fixed
The report gives no description here.
Open the reportMediumFinalizing withdrawal requests on the SharesCooldown contract allows for third-parties to override user’s chosen output tokenStrata Shares Cooldown Audit Report · Cyfrin · 23 Jan 2026Fixed
The report gives no description here.
Open the reportMediumIncrease in coverage can lead to a grief attack causing a DoS for previous withdrawal requestsStrata Shares Cooldown Audit Report · Cyfrin · 23 Jan 2026Fixed
The report gives no description here.
Open the reportMediumJR Tranche is susceptible to bankrun scenarios given that SharesCooldown finalization allows to bypass minimumJrtSrtRatio and first withdrawers from JR Tranche get a better cooldown and fees comparedStrata Shares Cooldown Audit Report · Cyfrin · 23 Jan 2026Fixed
The report gives no description here.
Open the reportMediumSharesCooldown instant finalization can be DoSed because of the UnstakeCooldown request limitsStrata Shares Cooldown Audit Report · Cyfrin · 23 Jan 2026Fixed
The report gives no description here.
Open the reportMediumTranche::burnSharesAsFee can be used to manipulate the exchange rate to cause withdrawals to revert for legitimate usersStrata Shares Cooldown Audit Report · Cyfrin · 23 Jan 2026Fixed
The report gives no description here.
Open the reportMediumLack of Decimal Precision Normalization Leads to Poor Slippage ProtectionStrata Tranches · Quantstamp · 28 Oct 2025Fixed
In the `deposit_viaSwap()` function, if the depositor does not specify `params.swapAmountOutMinimum`, the protocol attempts to set a default slippage tolerance based on the `minimumReturnPercentage` for a given input token set in the `autoSwaps` mapping. However, no decimal normalisation takes place to ensure the input and output tokens have the same amount of decimal precision. This means that when trading from a token with less decimals (for example USDT/USDC, which both have 6 decimals) to a token with more decimals (such as USDe which has 18 decimals) the `swapAmountOutMinimum` will be set to a value much smaller than intended, making the user susceptible to losing most of their input amount in slippage. Conversely, if performing a swap from a token with a large number of decimals to one with a smaller number, the default slippage tolerance will be set to a significantly larger number than the actual expected output causing the swap to always fail.
Open the reportMediumAPR Updates Rewrite The Previous Accrual WindowStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumCooldown Removal Ignores Pending RequestsStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportShow 10 more
MediumgrantCall Gives DEFAULT_ADMIN RoleStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumJRT maxMint Reverts When Share Price < 1Strata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumJRT maxWithdraw Redemption DoSStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumMissing updateAccounting CallStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumNegative APRs Break Accounting UpdatesStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumOld Data Can Overwrite Newer DataStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumOld Implementations Remain ActiveStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumRedeem Mistreats Shares As AssetsStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumreduceReserve Uses Stale AccountingStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumRisk > 100% Freezes Senior APR MathStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportShow 10 more
MediumsetMinimumJrtSrtRatio MutatesStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumTreasury Payouts Can Be DoSStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportMediumNAVs or APRs are updated using an outdated accounting on certain operationsStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportMediumProxy reuse without implementation check inside UnstakeCooldown leads to execution on outdated/vulnerable logicStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportMediumReducing reserves requesting USDe as the asset to receive causes the Strategy to release more sUSDe than necessaryStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportMediumTranche::maxMint for Junior Tranches is at risk of overflow when the jrNav falls below 1:1 rate to JR_SharesStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportMediumTranche::redeem calls super.withdraw instead of super.redeem causing users to receive fewer assetsStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportMediumWhen Senior’s TargetGain is negative, the tx will revert because the senior loss is not accounted for on the Junior Tranche as profit, causing the navs summation to not match the current navStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportMediumDoS of meta vault withdrawals during points phase if one vault is paused or attempted redemption exceeds the maximumStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportMediumMetaVault::redeemRequiredBaseAssets should be able to redeem small amounts from each vault to fill requested amount and avoid redeeming more than requestedStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportShow 10 more
MediumValue leakage due to pUSDe redemptions rounding against the protocol/yUSDe depositorsStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowAllowance-Based Withdrawals Can Revert Due to Cooldown Request Slot LimitsStrata Shares Cooldown Audit Report · Cyfrin · 23 Jan 2026Fixed
The report gives no description here.
Open the reportLowfinalizeWithFee lacks race conditioning protectionStrata Shares Cooldown Audit Report · Cyfrin · 23 Jan 2026Fixed
The report gives no description here.
Open the reportLowInvalid validateRedemptionParams checkStrata Shares Cooldown Audit Report · Cyfrin · 23 Jan 2026Fixed
The report gives no description here.
Open the reportLowSuggestion for a Time Delay for Fee UpdatesStrata - Update to Tranches · Quantstamp · 21 Nov 2025Fixed
The reviewed changes introduce the mechanic of a withdrawal fee, which a privileged address can set between 0 and 1% of the user’s withdrawal amount. As users might have deposited at a time without the concept of a withdrawal fee or with it being set at e.g. 0%, a sudden change to 1% has non-trivial consequences for user’s strategies. In order for users to have a sufficient time window to react to a change to the fee parameter, we propose adding a 24 hour delay between proposed new fee value and enforcing it on-chain.
Open the reportLowEnforced `minimumJrtSrtRatio` May Prevent Complete Withdrawals From the Junior VaultStrata Tranches · Quantstamp · 28 Oct 2025Fixed
When withdrawing from the junior vault, the `cdo.maxWithdraw()` function will validate that the user's withdrawal will not drop the junior to senior vault ratio below the `minimumJrtSrtRatio` value. When the protocol is operating normally this is an important check to ensure that there is a sufficient balance in the junior vault to handle potential shortfalls in the senior vault yield. However, in a protocol-wind-down scenario or in an emergency scenario, where a complete exit from the protocol is recommended, a non-zero `minimumJrtSrtRatio` would prevent all funds being removed from the junior vault until all funds have been removed from its senior counterpart.
Open the reportLowPermit-Based Deposit Can Be Front-RanStrata Tranches · Quantstamp · 28 Oct 2025Fixed
In the `TrancheDepositor.depositWithPermit()` function, the contract utilizes a token’s ERC-2612 permit functionality without protection against front-running attacks. The vulnerability stems from the deterministic nature of permit signatures and the lack of error handling when permit calls fail. An attacker can front-run the user's transaction, consume the signature provided to `depositWithPermit()` and force the `ERC2616.permit()` call made within the `depositWithPermit()` function to revert, impacting UX and causing the user to lose funds to transaction fees.
Open the reportLowERC20Cooldown Accepts Any TokenStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportLowFeed Updates Skip Accounting RefreshStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportLowIncorrect Validation In setProvider FunctionStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowMax Limits Ignore Min Shares GuardStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportLowMissing Event In Critical FunctionStrata Tranches Report · Guardian Audits · 10 Oct 2025Fixed
The report gives no description here.
Open the reportLowAccounting::setMinimumJrtSrtRatio sets reserveBps instead of minimumJrtSrtRatio making ratio configuration impossibleStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportLowDEFAULT_ADMIN_ROLE can be mistakenly granted to an account when granting permission to call fallback on any contractStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportLowFrontrunning to Block Junior Tranche WithdrawalsStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportLowInconsistent APR boundary validation between AprPairFeed and AccountingStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportLowInconsistent Risk Premium Validation in Accounting Allows Future Underflows or Zero APRStrata Tranches Audit Report · Cyfrin · 8 Oct 2025Fixed
The report gives no description here.
Open the reportLowMetaVault-Mechanic Could Be Used to Circumvent Paused State/Limits Enforced on Registered VaultsStrata PreDeposit Vaults · Quantstamp · 7 Jul 2025Fixed
The MetaVault enables different registered ERC4626 vault shares to be used similarly to USDe, the underlying asset of the vault. In the different deposits and withdraw flows involving those registered share tokens, the registered vault's `previewX()` functions are used to determine the appropriate converted amount to be tracked in the vault/the amount to be paid out. According to the ERC-4626 standard, however, the `previewX()` functions are supposed to not account for any withdrawal/deposit limits or pauses to the vault contract, they solely calculate the shares or underlying assets based on the conversion function at hand, ignoring additional state such as contract pause or deposit limits. For this fairly rare case of not just pricing the asset, but also making it interchangeably used with other registered share tokens and USDe, we think that the state-including check via the `maxX()` functions should additionally be performed.
Open the reportLowDuplicate vaults can be pushed to assetsArrStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowHard-coded slippage in pUSDeDepositor::deposit_viaSwap can lead to denial of serviceStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowIn pUSDeDepositor::deposit_viaSwap, using block.timestamp in swap deadline is not very effectiveStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowInability to remove and redeem from vaults with withdrawal issues could result in a bank-runStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowMetaVault::addVault should enforce identical underlying base assetStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowMetaVault::redeem erroneously calls ERC4626Upgradeable::withdraw when attempting to redeem USDe from pUSDeVaultStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowNo way to compound deposited supported vault assets into sUSDe stake during yield phaseStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowpUSDeVault::maxDeposit doesn’t account for deposit pausing, in violation of EIP-4626 which can break protocols integrating with pUSDeVaultStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowpUSDeVault::maxMint doesn’t account for mint pausing, in violation of EIP-4626 which can break protocols integrating with pUSDeVaultStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowpUSDeVault::maxRedeem doesn’t account for redemption pausing, in violation of EIP-4626 which can break protocols integrating with pUSDeVaultStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowpUSDeVault::maxWithdraw doesn’t account for withdrawal pausing, in violation of EIP-4626 which can break protocols integrating with pUSDeVaultStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowpUSDeVault::startYieldPhase should not remove supported vaults from being supported or should prevent new supported vaults once in the yield phaseStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportShow 4 more
LowUpgradeable contracts which are inherited from should use ERC7201 namespaced storage layouts or storage gaps to prevent storage collisionStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowUse SafeERC20::forceApprove instead of standard IERC20::approveStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowyUSDeVault edge cases should be explicitly handled to prevent view functions from revertingStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportLowyUSDeVault inherits from PreDepositVault but doesn’t call onAfter- DepositChecks or onAfterWithdrawalChecksStrata PreDeposit Audit Report · Cyfrin · 11 Jun 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="strata"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us