# Beraborrow Managed Dens audit Sherlock · CDP stablecoin · 25th April 2025 A private security review of Beraborrow (CDP stablecoin), conducted with Sherlock and completed on 25th April 2025 over 6 days. 0xSimao disclosed 19 findings: 1 high severity, 8 medium and 10 low. ## What Beraborrow is Beraborrow is a CDP stablecoin on Berachain: NECT is minted against collateral held in dens, and managed leveraged vaults open, lever and unwind those positions on depositors' behalf, with withdrawals settling through epoch-based queues against what the vault actually holds. ## Scope The Sherlock review covered the blockend repository's managed-den machinery: deposit and withdrawal flows with their slippage controls, the epoch accounting that matches exiting depositors to unwound debt, leverage adjustments, and the ICR checks that keep a managed den solvent through partial exits. ## High severity findings - [Lost withdrawals due to `ManagedLeveragedVault::openDen()` using all `asset()` balance](https://0xsimao.com/findings/beraborrow-i-lost-withdrawals-managed-den) ## Medium severity findings - [`ManagedLeveragedVault.sol::deposit()` is missing slippage control](https://0xsimao.com/findings/beraborrow-i-sol-deposit-slippage-control) - [DoSed withdrawals due to `ManagedLeveragedVault::executeWithdrawalEpoch()` repaying debt above limit](https://0xsimao.com/findings/beraborrow-i-withdrawals-withdrawal-epoch-debt) - [`ManagedLeveragedVault::executeWithdrawalEpoch()` will never work because `cd.prevICR` is not set](https://0xsimao.com/findings/beraborrow-i-withdrawal-epoch-prev-icr) - [`ManagedLeveragedVault::increaseLeverage()` fails when the debt is closed to the limit](https://0xsimao.com/findings/beraborrow-i-leverage-fails-debt-closed) - [`ManagedLeveragedVault::decreaseLeverage()` will not work when it goes below the minimum debt](https://0xsimao.com/findings/beraborrow-i-decrease-goes-below-debt) - [Protocol will need to donate minimum debt for all new ManagedLeveragedVaults](https://0xsimao.com/findings/beraborrow-i-need-donate-debt-vaults) - [Missing several `safeERC20` functions](https://0xsimao.com/findings/beraborrow-i-several-safe-erc20-functions) - [`ManagedLeveragedVault::executeWithdrawalEpoch()` incorrect ICR and DoSed withdrawals due to not accouting for fees](https://0xsimao.com/findings/beraborrow-i-withdrawal-epoch-withdrawals-fees) ## Low severity findings - [Unused/useless code](https://0xsimao.com/findings/beraborrow-i-unused-useless-code) - [Hints on withdrawal may fail as the ICR changes between claiming collateral surplus and repaying debt](https://0xsimao.com/findings/beraborrow-i-hints-withdrawal-collateral-debt) - [`ManagedLeveragedVault::deposit()` slippage control on `collVaultShares` is not intuitive](https://0xsimao.com/findings/beraborrow-i-deposit-slippage-control-shares) - [Incorrect `ERC4626ExceededMaxRedeem` event on `ManagedLeveragedVault.sol:: cancelWithdrawalIntent()`](https://0xsimao.com/findings/beraborrow-i-erc4626-exceeded-redeem-withdrawal) - [`ManagedLeveragedVault::increaseLeverage()` will never work in Recovery mode](https://0xsimao.com/findings/beraborrow-i-leverage-work-recovery-mode) - [`ManagedLeveragedVault::getAvailableDebt()` used in `ManagedLeveragedVault::increaseLeverage()` is incorrect](https://0xsimao.com/findings/beraborrow-i-available-debt-increase-leverage) - [`ManagedLeveragedVault::donateCollateral()` is missing a slippage check](https://0xsimao.com/findings/beraborrow-i-managed-donate-collateral-slippage) - [Some view functions will not work under certain conditions](https://0xsimao.com/findings/beraborrow-i-view-work-certain-conditions) - [`ManagedLeveragedVault::getDebtToUnwindAndCollRequested()` is inaccurate when there are surplus tokens](https://0xsimao.com/findings/beraborrow-i-debt-unwind-requested-inaccurate) - [Most `ManagedLeveragedVault` functions are DoSed due to bad debt check](https://0xsimao.com/findings/beraborrow-i-managed-functions-bad-debt) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-04-25-beraborrow-i.pdf)