Skip to content
Request an audit

‹ Findings database

CEI pattern is not followed on LoopedVault::fulfillWithdraw()

Low/InfoYieldoor LoopedVault Update audit·by 0xSimao·Leveraged yield farming·23rd June 2025L-3

Description:

LoopedVault::fulfillWithdraw() transfers the asset before updating the state, breaking the CEI pattern.

Recommended Mitigation:

Transfer the assets at the end of the function.

0xSimao:

Fixed in #2a378db.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests