Vesu Vault Allocator
Sherlock collaborative audit · CODESPECT as Lead Security Expert
About the Protocol
Ekubo liquidity adapter, CCTP/Hyperlane/LayerZero bridge middlewares and decoder-sanitizers for the Vesu vault allocator on Starknet.
Findings (11)
Ekubo adapter cannot collect pending fees on a full withdrawal
withdraw_liquidity(...) does not collect pending fees, and a full withdrawal clears the NFT identifier, leaving the accrued fees permanently unclaimable.
Bridge middlewares can be denied service with a dust donation
The bridging function requires the contract's token_to_claim balance to be zero, so donating dust of that token blocks new cross-chain swaps indefinitely.
Permissionless claim_token(...) lets anyone grief a pending bridge request
claim_token(...) can be called by anyone and clears a request's pending_balance, so with several requests outstanding for one token a user can settle another's request.
Bridge middlewares evaluate slippage at claim time, not at swap time
Slippage is checked when the claim executes rather than when the swap is initiated, so the bound does not reflect the price at the time the user committed.
Strategy permission control cannot be assigned per strategy
set_vault_configs(...) overwrites the entire strategy configuration on every call, preventing independent permissions across strategies.
Ready to secure your project?
Get a free 30-minute security assessment. We’ll review your codebase scope and flag the top 3 risk areas.
No commitment required · Typical audits start within 1–2 weeks