Tea-Fi security record
As of 21 Oct 2026, Tea-Fi has 4 audit reports by 1 security firm on Trustblock; the latest is by Halborn, dated 31 Oct 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits4
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Paymaster Contracts | Security firm: Halborn | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · halborn.com |
| Noga Fallback Contracts | Security firm: Halborn | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · halborn.com |
| Bridge Contracts | Security firm: Halborn | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · halborn.com |
| Steam-Fi Pre-Vault | Security firm: Halborn | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · halborn.com |
Findings30
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 2 | 7 |
| Low | 0 | 2 | 19 |
MediumRounding Down in Token Fee Calculation Causes UnderpaymentPaymaster Contracts · Halborn · 31 Oct 2025Fixed
The report gives no description here.
Open the reportMediumStrict Slippage Configuration Causes Swap RevertsPaymaster Contracts · Halborn · 31 Oct 2025Fixed
The report gives no description here.
Open the reportMediumFee-on-Transfer Token Handling Causes Refund Failures or User Profit from Contract BalanceNoga Fallback Contracts · Halborn · 20 Oct 2025Fixed
The report gives no description here.
Open the reportMediumFront-Running Permit Signatures Causes Transaction ReversionNoga Fallback Contracts · Halborn · 20 Oct 2025Fixed
The report gives no description here.
Open the reportMediumGriefing Attack via Zero Allowance Causing Relayer Gas LossNoga Fallback Contracts · Halborn · 20 Oct 2025Fixed
The report gives no description here.
Open the reportMediumPossible Yield Leakage When Requested Amount Exceeds Booked PrincipalBridge Contracts · Halborn · 9 Oct 2025Fixed
The report gives no description here.
Open the reportMediumReward Forfeiture Due to Improper Vault Strategy IntegrationSteam-Fi Pre-Vault · Halborn · 23 Sep 2025Fixed
The report gives no description here.
Open the reportLowFOT (Fee-On-Transfer) Tokens can Cause Reverts and are Unsupported in PostOp SwapsPaymaster Contracts · Halborn · 31 Oct 2025Fixed
The report gives no description here.
Open the reportLowUnbounded Loop in Batch WithdrawalPaymaster Contracts · Halborn · 31 Oct 2025Fixed
The report gives no description here.
Open the reportLowwithdrawTokensBatch() Lacks Zero-Amount ValidationPaymaster Contracts · Halborn · 31 Oct 2025Fixed
The report gives no description here.
Open the reportShow 10 more
LowLack of Emergency Role or Protocol Pause Check for Emergency WithdrawalsNoga Fallback Contracts · Halborn · 20 Oct 2025Fixed
The report gives no description here.
Open the reportLowMissing Interface Registrations in DiamondInit Breaks ERC-165 ComplianceNoga Fallback Contracts · Halborn · 20 Oct 2025Fixed
The report gives no description here.
Open the reportLowRedundant permit2 Initialization in Diamond DeploymentNoga Fallback Contracts · Halborn · 20 Oct 2025Fixed
The report gives no description here.
Open the reportLowUnnecessary BaseFacet Inheritance in DiamondCutFacetNoga Fallback Contracts · Halborn · 20 Oct 2025Fixed
The report gives no description here.
Open the reportLowUnnecessary msg.value > 0 Check in _validateCall()Noga Fallback Contracts · Halborn · 20 Oct 2025Fixed
The report gives no description here.
Open the reportLowUnused Admin Parameter in DiamondInit InitializationNoga Fallback Contracts · Halborn · 20 Oct 2025Fixed
The report gives no description here.
Open the reportLowNo Emergency Exit From StrategyBridge Contracts · Halborn · 9 Oct 2025Fixed
The report gives no description here.
Open the reportLowNo maxFee Bound Allows Fee SpikesBridge Contracts · Halborn · 9 Oct 2025Fixed
The report gives no description here.
Open the reportLowNo Validation of Divested Amounts in withdraw() / redeem()Bridge Contracts · Halborn · 9 Oct 2025Fixed
The report gives no description here.
Open the reportLowUnlimited Allowance to Aave PoolBridge Contracts · Halborn · 9 Oct 2025Fixed
The report gives no description here.
Open the reportShow 6 more
LowArtificial APY Limitation Restricting Protocol FlexibilitySteam-Fi Pre-Vault · Halborn · 23 Sep 2025Fixed
The report gives no description here.
Open the reportLowDecimal Precision Misconfiguration in Price ParametersSteam-Fi Pre-Vault · Halborn · 23 Sep 2025Fixed
The report gives no description here.
Open the reportLowExcess ETH Refund Can Be Redirected to Arbitrary User in SteamFiVault.sol::_receiveAssets()Steam-Fi Pre-Vault · Halborn · 23 Sep 2025Fixed
The report gives no description here.
Open the reportLowFee-on-Transfer Token Incompatibility in Staking Vault ContractSteam-Fi Pre-Vault · Halborn · 23 Sep 2025Fixed
The report gives no description here.
Open the reportLowMissing Weight Sum Validation in Reward DistributionSteam-Fi Pre-Vault · Halborn · 23 Sep 2025Fixed
The report gives no description here.
Open the reportLowNo Check for Duplicate Reward Assets in addRewardAsset()Steam-Fi Pre-Vault · Halborn · 23 Sep 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="tea-fi"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us