# Aegis Staked YUSD audit Sherlock · Bitcoin-backed stablecoin · 22nd April 2025 A private security review of Aegis (bitcoin-backed stablecoin), conducted with Sherlock and completed on 22nd April 2025 over 2 days. 0xSimao disclosed 3 findings: 1 high severity and 2 low. ## What Aegis is Aegis issues YUSD, a Bitcoin-backed stablecoin. Its staked layer is an ERC-4626-style vault where YUSD holders stake to earn the protocol's reward flow, with deposits, withdrawals and reward distribution mediated by the vault's share accounting. ## Scope The Sherlock review covered the staked YUSD vault: share pricing on entry, the bounds the exit path puts on what a leaver takes, reward distribution, and how donations or direct transfers into the vault move the share price for everyone else. ## High severity findings - [Attacker can DoS user withdrawals at no cost](https://0xsimao.com/findings/aegis-attacker-user-withdrawals-cost) ## Low severity findings - [Missing `maxRedeem()` implementation](https://0xsimao.com/findings/aegis-missing-max-redeem-implementation) - [Donation attack possible, although unlikely, could make an initial deposit](https://0xsimao.com/findings/aegis-donation-although-unlikely-deposit) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-04-22-aegis.pdf)