Cap audit contest
A public audit contest on Sherlock (stablecoin issuer), completed on 10th July 2025. 0xSimao placed #14. 2 of his findings are published: 2 medium.
What Cap is
Cap is a stablecoin protocol on Ethereum with two products: cUSD and stcUSD. cUSD is a digital dollar, backed by blue chip dollar assets like BENJI and USDC. stcUSD is a savings product that generates yield via an autonomous layer of operators.
Scope
The Sherlock contest covered cap-contracts, 50 files and 2,405 nSLOC: cUSD minting and redemption against its blue-chip dollar backing, the stcUSD savings vault, and the operator layer that generates and settles the yield.
Medium severity findings
ViewLogic::maxLiquidatable()doesn't take the bonus into account, making the agent liquidatable again- Cannot repay or liquidate on paused asset
The contest