As our Lead Senior Watson for the first audit competition of the Beraborrow codebase, 0xSimao demonstrated clear proficiency. He identified one third of the verified issues in a 6.2k SLOC codebase, a testament to his thoroughness and auditing skills. Additionally, his contributions during the fix review process were instrumental in uncovering further issues. His dedication to client security, transparent communication, and client success is exemplary.
Beraborrow
What it is
Beraborrow issues a CDP stablecoin against collateral held in managed leveraged vaults, which borrow and rebalance on the depositor’s behalf.
What was reviewed
Three engagements: the first audit competition of the codebase, where the vaults placed it second, and two private reviews of the managed leveraged vaults with Sherlock in April and June 2025.
What was found
19 findings across the 3 engagements, 8 of them medium severity.
Featured finding
Beraborrow’s vaults borrow against deposited collateral and hold some assets back for depositors who have asked to leave. Opening a new position swept the entire balance into collateral, the reserved part included, so the vault’s record of what it owed stopped matching what it held.
As designedDepositors ask to leave and their share is set aside↓A new position is opened with the fresh collateral only↓The reserved assets stay reserved↓The leavers are paid what was set aside for them
The path the bug allowedDepositors ask to leave and their share is set aside↓Opening a new position sweeps the vault’s entire balance into collateral, the reserved part included↓The vault’s record of what it owes stops matching what it holds↓The withdrawals that were set aside can no longer be paid
