vusd security record
As of 3 Nov 2026, vusd has 1 audit report on Trustblock, by Quantstamp, dated 6 May 2025. That report lists no open critical findings.
Record last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits1
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| vusd-stablecoin | Security firm: Quantstamp | Date: | Scope: Repository at commit 7b66754 | No open critical findings | Open · certificate.quantstamp.com |
Findings10
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 1 |
| Low | 7 | 0 | 1 |
HighStablecoin Arbitrage Leads to Potential for Vusd to Become Undercollateralizedvusd-stablecoin · Quantstamp · 6 May 2025Fixed
The core invariant of the protocol is that the VUSD token should always be backed at least 1:1 by the stablecoins held in its treasury. However because VUSD tokens are minted to users based on the oracle price of the stablecoin being deposited, there is an opportunity for arbitrageurs to mint more VUSD with stablecoins that have temporarily deviated slightly above one dollar. They can then immediately redeem this VUSD for another of the whitelisted stablecoins that price has not deviated from one dollar. This scenario allows the arbitrageur to make a small profit, but more importantly means that when the deviated price of the first stable coin returns to one dollar the protocol will now be slightly undercollateralized. Over time this could be repeated whenever such a price deviation occurs to slowly force the protocol to become more and more undercollateralized.
Open the reportMediumStale Oracle Price Data Not Checked Before Token Operations May Drain Assets From Protocolvusd-stablecoin · Quantstamp · 6 May 2025Fixed
The Redeemer and Minter contracts use Chainlink oracles to fetch price data for stablecoins to calculate redemption and minting amounts. However, these contracts only check if the price falls within a tolerance range but don not verify the freshness of the price data. In the `_calculateRedeemable()` function of the Redeemer contract and the `_calculateMintage()` function of the Minter contract, the code calls `latestRoundData()` but only uses the price value without checking the timestamp of when this price was last updated.
Open the reportLowLack of Slippage Protection on Mint and Redeem Functionsvusd-stablecoin · Quantstamp · 6 May 2025Fixed
When minting and redeeming tokens within the protocol there is an expectation that the user will know how many tokens they are going to receive. However in certain scenarios the user may receive less tokens than they expected when they submitted the transaction. This could happen in a number of scenarios including: - The oracle price is updated, changing the value of the underlying stable coins. - The governor changes the `mintingFee` while a user's transaction is pending. In the current implementation the user has no control over this and their transaction would succeed even if the number of tokens they receive is unfavorable.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="vusd"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us