Yield Basis security record
As of 21 Oct 2026, Yield Basis has 2 audit reports by 2 security firms on Trustblock; the latest is by Quantstamp, dated 25 Apr 2025. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits2
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Yield Basis | Security firm: Quantstamp | Date: | Scope: Repository at commit 16b1780 | No open critical findings | Open · certificate.quantstamp.com |
| YieldBasis security review | Security firm: Pashov Audit Group | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings21
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 0 | 11 |
| Low | 2 | 0 | 5 |
HighIncorrect Flashloan IntegrationYield Basis · Quantstamp · 25 Apr 2025Fixed
The `VirtualPool` contract makes use of a crvUSD flashloan provider to amplify user arbitrage for price correction. However, the flashloan integration is incomplete. 1. The `onFlashLoan()` function needs to be external according to ERC3156. 2. The `onFlashLoan()` function should verify the `initiator` and `token` addresses. 3. The `exchange()` function calls a `FLASH.ceiling()` function that appears to be undefined based on the intended integrated flash contract, [Curve Flashlender](https://etherscan.io/address/0x26de7861e213a5351f6ed767d00e0839930e9ee1#code). 4. The `exchange()` function should be `@nonreentrant`.
Open the reportHighNo Fee Enforcement in `LT` ContractYield Basis · Quantstamp · 25 Apr 2025Fixed
`LT.min_admin_fee` is never assigned, preventing any admin fees to be charged from the LT contract.
Open the reportHighStaker Address Update Does Not Transfer Staker's BalanceYield Basis · Quantstamp · 25 Apr 2025Fixed
If the `set_staker()` function is called and the `staker` address is updated without transferring the previous staker's `balanceOf` to the new staker, the following issues could arise: 1. The previous staker's balance would remain with the old staker's address, leaving the new staker with a zero balance. This could lead to a situation where the new staker cannot perform any operations that require a balance, such as withdrawing staked tokens. 2. Incorrect calculations of staked tokens would result in the `_calculate_values()` function producing different values than expected.
Open the reportMediumOverleveraging After Allocator's Stablecoins Are ReclaimedYield Basis · Quantstamp · 25 Apr 2025Fixed
If the `Factory` contract `admin` were to reclaim the `Factory`'s allocated crvUSD from the `AMM` contract via `LT.allocate_stablecoins()`, the `LT` contract debt could become higher than half of the available crvUSD. In such a case, the protocol could become insolvent, resulting in halted deposits and imbalanced reserves, potentially preventing the execution of the `AMM.exchange()` function.
Open the reportMediumStaker Is Not Updated in Some CasesYield Basis · Quantstamp · 25 Apr 2025Fixed
If the `Factory` creates a market using `add_market()` before a `staker_impl` is set, a staker can be added later by calling the `fill_staker_vpool()` function. However, this function does not call the `LT.setStaker()` function to update the staker in the `LT` contract.
Open the reportMediumIncorrect total supply calculated during admin fee withdrawalYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportMediumnew_total_value is assumed to be non- negativeYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportMediumRebase bypass possible through _transfer()YieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportMediumset_allocator() state update missing causes incorrect balancesYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportMediumset_rate() resets accrued fees causing fee lossYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportShow 9 more
MediumState not updated when staker address changesYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportMediumToken miscalculation in withdraw_admin_fees() inflates sharesYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportMediumToken rebase miscalculation during position lossesYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportMediumwithdraw does not reduce staked data when staker is callerYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportLowMissing Setter Function for `staker_impl`Yield Basis · Quantstamp · 25 Apr 2025Fixed
In the function `fill_staker_vpool()`, a `staker` contract is deployed for the given `market` if the `staker_impl` contract address is set and if the `staker` contract was not already deployed from executing `add_market()`. However, the `staker_impl` contract address is not updatable in the `Factory` contract. Therefore, if the `staker_impl` is not set during deployment, the `staker` contract will not be deployed when `fill_staker_vpool()` is called as the following code block will never execute: ``` if market.staker == empty(address) and self.staker_impl != empty(address): market.staker = create_from_blueprint( self.staker_impl, market.lt) ```
Open the reportLowdeposit fails to account for cases where value_before equals 0YieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportLowfill_staker_vpool() fails without address settersYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportLowmin_admin_fee lacks initialization and updateYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportLowStaker contract missing in LT contract post- creationYieldBasis security review · Pashov Audit Group · 1 Apr 2025Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="yield-basis"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us