Syntetika security record
As of 21 Oct 2026, Syntetika has 3 audit reports by 2 security firms on Trustblock; the latest is by Cyfrin, dated 2 May 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Syntetika CCIP-CCT Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Syntetika HilBTC | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Syntetika Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings37
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 9 |
| Low | 0 | 1 | 23 |
Marked Informational or Gas by the firms. Not counted as findings.
InformationalComplianceChecker::isCompliant incorrectly returns true if compliance options have no required soul bound tokensSyntetika Audit Report · Cyfrin · 1 Aug 2025Acknowledged
The report gives no description here.
Open the reportInformationalConsider using a staking rewards distributor to efficiently space out staking rewards, further deterring just-in-time attacksSyntetika Audit Report · Cyfrin · 1 Aug 2025Acknowledged
The report gives no description here.
Open the reportInformationalMinter::ownerMint bypasses whitelist requirement and increases totalDeposits without actually transferring any tokensSyntetika Audit Report · Cyfrin · 1 Aug 2025Acknowledged
The report gives no description here.
Open the reportInformationalNot check for timestamp in distributeYield could DoS the distribute rewardsSyntetika Audit Report · Cyfrin · 1 Aug 2025Acknowledged
The report gives no description here.
Open the reportGasSmall functions only used once should be inlined into their parent functionsSyntetika Audit Report · Cyfrin · 1 Aug 2025Acknowledged
The report gives no description here.
Open the reportInformationalBlacklistableUpgradeable::__Blacklistable_init callable publicly during initializationSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportGasCache repeated storage reads on success path across multiple settersSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalCosmetic code cleanups: typo, unused imports, inconsistent types and wrong error nameSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalCUSTODIAN_ROLE is granted/revoked but never gates any functionSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalDistributor::rescueERC20 uses string error messages inconsistent with project style and ignores transfer return valueSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalDocumentation mismatches: NatSpec, docstrings and comments disagree with codeSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalHilToken::_update and StakingVault::_update check blacklist status of address(0)Syntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalInconsistent access-control patterns: mixed Ownable/AccessControl and mixed internal/external role revocationSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalMissing NatSpec on public-facing functions with non-obvious behaviourSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalMissing zero-address and zero-amount input validation across constructors, initializers and settersSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalSolidity compiler version and toolchain configuration drift across the repoSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalStakingVault::_deposit with minAssetsAmount > DEAD_SHARES bricks vault seedingSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalStakingVault::_withdraw last-user branch reverts with ERC20InvalidReceiver when owner is renounced to zero - DoS of last-user exit during vesting windowSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalStakingVault::_withdraw resets $.lastDistributionTimestamp to 0Syntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalStakingVault::setDistributor and Minter::setDistributor are independent - rotating one without the other silently bricks the yield pipelineSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalStakingVault::setEarlyExitFeeRecipient defaults to address(this) and permits self-target - fees silently boost share priceSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalTokensHolder::withdraw + Distributor::rescueERC20 use raw transfer without SafeERC20Syntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalTokensHolder::withdraw discards transfer return value and missing eventSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportGasUse calldata instead of memory for external function string parametersSyntetika CCIP-CCT Audit Report · Cyfrin · 2 May 2026Fixed
The report gives no description here.
Open the reportInformationalStakingVault Has No Initial BlacklisterSyntetika HilBTC · ChainSecurity · 31 Oct 2025Fixed
The report gives no description here.
Open the reportGasCache storage to prevent identical storage readsSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalConsider using SafeCast when downcasting amountsSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalDon’t initialize to default values in SoliditySyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalEmit missing event informationSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalEnforce minimum transaction amounts in StakingVaultSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalEnforce that StakingVault::decimals is greater or equal to the underlying asset decimalsSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalMissing call to _setGlobalWhitelist in Minter.solSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalMissing redeem convenience function in the StakingVault.solSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalPrefer explicit uint sizesSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportGasRemove from parameter from Minter:redeem and _onlySender functionSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalRemove obsolete return statements when using named return variablesSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalRevert if StakingVault::deposit, mint, redeem, withdraw would return zeroSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalRoles not set in deposit-registry contract constructorsSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalStakingVault::claimWithdraw should revert if assets are zeroSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalStakingVault::distributeYield should revert when there are no vault sharesSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportShow 5 more
InformationalUse named importsSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportInformationalUse named mapping parameters to explicitly note the purpose of keys and valuesSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportGasUse named return variables when this eliminates local variablesSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportGasUse ReentrancyGuardTransient for faster nonReentrant modifiersSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportGasVariables only set once in constructor of non-upgradeable contracts should be declared immutableSyntetika Audit Report · Cyfrin · 1 Aug 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="syntetika"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us