Vesu security record
As of 31 Oct 2026, Vesu has 10 audit reports by 3 security firms on Trustblock; the latest is by Sherlock, dated 21 Feb 2026. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits10
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Vesu audit | Security firm: Sherlock | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Vesu audit | Security firm: Sherlock | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Vesu V2 | Security firm: ChainSecurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · chainsecurity.com |
| vesu protocol security review | Security firm: Cairo Security Clan | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| Vesu protocol security review | Security firm: Cairo Security Clan | Date: | Scope: Repository at commit 5f1274f | No open critical findings | Open · IPFS |
| vesu protocol security review | Security firm: Cairo Security Clan | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| Vesu protocol security review | Security firm: Cairo Security Clan | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| Vesu protocol security review | Security firm: Cairo Security Clan | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| vesu protocol security review | Security firm: Cairo Security Clan | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
| Vesu Protocol Security Review | Security firm: Cairo Security Clan | Date: | Scope: Files named in the report | No open critical findings | Open · IPFS |
Findings36
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 2 |
| Medium | 0 | 0 | 6 |
| Low | 1 | 4 | 22 |
HighMissing ownership validation of positions allows unauthorized migrationVesu audit · Sherlock · 13 Nov 2025Fixed
The report gives no description here.
Open the reportHighfixed shutdown mode is bypassed in function shutdown_statusvesu protocol security review · Cairo Security Clan · 12 Mar 2025Fixed
The fixed shutdown mode, which is set by the pool owner, is intended to take precedence over the shutdown mode inferred from the system. However, the shutdown_status function checks the inferred mode first and returns immediately if a valid mode is found, bypassing the fixed shutdown mode that should override it. Recommendation: Consider checking the fixed shutdown mode first and returning if the result is not normal mode.
Open the reportMediumBridge middlewares are prone to DOS from small donationsVesu audit · Sherlock · 21 Feb 2026Fixed
The report gives no description here.
Open the reportMediumBridge middlewares claiming can be griefedVesu audit · Sherlock · 21 Feb 2026Fixed
The report gives no description here.
Open the reportMediumEkubo adapter fee collection flag prevents collection of pending fees on full withdrawalVesu audit · Sherlock · 21 Feb 2026Fixed
The report gives no description here.
Open the reportMediumDOS for certain scenarios depending on the LTVs of the 2 positionsVesu audit · Sherlock · 13 Nov 2025Fixed
The report gives no description here.
Open the reportMediumFunction attribute_fee_shares not called when writing new asset config results in fee being stuck in singletonVesu protocol security review · Cairo Security Clan · 29 Jun 2024Fixed
When writing new asset config to storage, attribute_fee_shares is sometimes not called, causing total_collateral_shares to increase but shares not accounted in any address. This results in shares that cannot be redeemed and remain stuck indefinitely.
Open the reportMediumThe invalid price could be used for liquidation in normal modeVesu protocol security review · Cairo Security Clan · 29 Jun 2024Fixed
Given that the operator precedence in the before_liquidate_position function only checks price validity for recovery mode, invalid prices could be used for liquidation in normal mode. The price fetched from the pragma oracle might be a timeout price or have fewer sources but still be accepted for liquidation.
Open the reportLowBridging middleware cannot be reused across configurationsVesu audit · Sherlock · 21 Feb 2026Fixed
The report gives no description here.
Open the reportLowMissing claim_all_coll_gains operation in UncapDecoderAndSanitizerVesu audit · Sherlock · 21 Feb 2026Fixed
The report gives no description here.
Open the reportShow 10 more
LowRedundant approval operation in HyperlaneMiddlewareVesu audit · Sherlock · 21 Feb 2026Fixed
The report gives no description here.
Open the reportLowThe Avnu Middleware initializes the owner twiceVesu audit · Sherlock · 21 Feb 2026Fixed
The report gives no description here.
Open the reportLowBad Debt Rounding Can Be Exploited to Pay off Less DebtVesu V2 · ChainSecurity · 30 Sep 2025Fixed
The report gives no description here.
Open the reportLowclaim_fees() Rounding upVesu V2 · ChainSecurity · 30 Sep 2025Fixed
The report gives no description here.
Open the reportLowVToken Checks Invariants on the Caller AddressVesu V2 · ChainSecurity · 30 Sep 2025Fixed
The report gives no description here.
Open the reportLowApproval amount is more than needed in case add_margin_is_wrapped trueVesu protocol security review · Cairo Security Clan · 12 Mar 2025Fixed
When add_margin_is_wrapped is true, the margin asset deposited is already the wrapped vault token. The transfer logic excludes margin_amount properly, but approval logic unnecessarily approves the sum of margin_amount and lever_amount for the debt asset causing over-approval, which is inefficient and could pose security risks. Recommendation is to approve only lever_amount when add_margin_is_wrapped is true.
Open the reportLowMissing check for add_margin_is_wrapped when swapping margin asset to debt assetVesu protocol security review · Cairo Security Clan · 12 Mar 2025Fixed
The multiply4626 contract swaps the margin token to the debt token if needed, but lacks a check to enforce add_margin_is_wrapped is false when swapping occurs. This could cause incorrect logic flows. Recommendation is to add a check to ensure add_margin_is_wrapped is false when swapping margin asset to debt asset.
Open the reportLowoverwrite shutdown mode not implemented in ekubo oracle extensionvesu protocol security review · Cairo Security Clan · 12 Mar 2025Fixed
The latest update to the vesu protocol introduces the ability to manually overwrite the shutdown mode across all existing default extensions. However, the ekubo oracle extension does not include this functionality, creating inconsistency with other extensions. Recommendation: Implement the ability to overwrite the shutdown mode in the ekubo oracle extension to maintain consistency.
Open the reportLowMissing sign check for swap amountVesu protocol security review · Cairo Security Clan · 31 Aug 2024Fixed
In the increase_lever function, after a swap operation, the function swap returns a pair of values in_amount and out_amount. Due to differences between "swap exact in" and "swap exact out" operations, it is necessary to identify which amount corresponds to collateral and which to margin using the token address. The code assumes margin_amount > 0 and collateral_amount > 0 and proceeds to transfer the amounts and handle the delta accordingly. However, these assumptions are not verified before casting the amounts to i129_new. A similar issue exists in the increase_lever and decrease_lever functions when handling leverage swaps. Recommendation: Consider implementing a check to verify the sign of the amounts before casting them to i129_new.
Open the reportLowInconsistent ltv config validation between create_pool and set_ltv_configVesu protocol security review · Cairo Security Clan · 29 Jun 2024Fixed
The report gives no description here.
Open the reportShow 10 more
LowIncorrect documentation for function claim_feesVesu protocol security review · Cairo Security Clan · 29 Jun 2024Fixed
The report gives no description here.
Open the reportLowIncorrect documentation for function pow_scaleVesu protocol security review · Cairo Security Clan · 29 Jun 2024Fixed
The report gives no description here.
Open the reportLowPotential denial of service during pool creationVesu protocol security review · Cairo Security Clan · 29 Jun 2024Fixed
The report gives no description here.
Open the reportLowPotentially misleading function naming for assert_config_existsVesu protocol security review · Cairo Security Clan · 29 Jun 2024Fixed
The report gives no description here.
Open the reportLowThe function pow might result with unexpected behavior if base is zeroVesu protocol security review · Cairo Security Clan · 29 Jun 2024Fixed
The report gives no description here.
Open the reportLowinsufficient partial swap checkvesu protocol security review · Cairo Security Clan · 9 Jun 2024Fixed
The vesu liquidate contract uses Ekubo for token swaps where a route consists of multiple token pairs. The sqrt_ratio_limit for each pair constrains the maximum and minimum trade prices. If the limit is set too close to the current market price, Ekubo might not have sufficient liquidity to complete the entire swap, leading to partial swaps. The contract currently checks only the first swap for partial execution but not subsequent swaps.
Open the reportLowliquidateresponse event should include token address to avoid confusionvesu protocol security review · Cairo Security Clan · 9 Jun 2024Fixed
In the liquidate_position function, the liquidateresponse event emits the residual_collateral amount. If the residual collateral is swapped for another token, this amount then refers to the new token amount, which can cause confusion and impact UI/UX. The audit recommends including the output token address in the event.
Open the reportLowusers are forced to liquidate all debt of the positionvesu protocol security review · Cairo Security Clan · 9 Jun 2024Fixed
The vesu liquidate contract requires users to liquidate the entire debt of a position in a single transaction. This mandatory full liquidation can limit flexibility and negatively affect swap prices on Ekubo, potentially resulting in unprofitable liquidations. The audit suggests allowing partial liquidations to provide greater flexibility.
Open the reportLowDefine singleton dispatcher when using repeatedlyVesu Protocol Security Review · Cairo Security Clan · 12 Feb 2024Fixed
In the function add_asset, the singleton dispatcher variable is defined but not used in the first external call to set_asset_config, only in modify_position. It is recommended to define the singleton dispatcher above and use it in both calls.
Open the reportLowUnchecked return values of ERC20 transferVesu Protocol Security Review · Cairo Security Clan · 12 Feb 2024Fixed
In the codebase, ERC20 transfers using transferFrom return a boolean indicating success, but the return values are not checked. This may cause unexpected behavior if the token does not revert on failure.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="vesu"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us