# Evro Collateral Onboarding audit Sherlock · EUR stablecoin · 26th December 2025 A private security review of Evro Finance (EUR stablecoin), conducted with Sherlock and completed on 26th December 2025 over 5 days. 0xSimao disclosed 9 findings: 2 high severity, 4 medium and 3 low. ## What Evro Finance is Evro issues a euro stablecoin against overcollateralised troves, in the Liquity V2 mould: each collateral asset runs its own borrowing branch with a dedicated price feed, positions live as trove NFTs, and zappers bundle the wrapping and swap legs a deposit needs into one call. ## Scope The December review covered the collateral plumbing: price feeds for GNO, osGNO, sDAI, WBTC, WETH and wstETH, the eight-decimal WBTC wrapper and its zapper, the CoGNO adapter, the trove NFT and the Curve exchange leg. ## Findings ### High - [SDAIPriceFeed is vulnerable to donation attack via manipulatable vault rate](https://0xsimao.com/findings/evro-finance-ii-sdai-price-donation-manipulatable) - [WSTETHPriceFeed returns USD price Instead of EUR on oracle failure](https://0xsimao.com/findings/evro-finance-ii-wsteth-price-eur-oracle) ### Medium - [WBTCZapper decimal mismatch causes revert](https://0xsimao.com/findings/evro-finance-ii-zapper-decimal-mismatch-revert) - [WBTCZapper approves wrong token for exchange](https://0xsimao.com/findings/evro-finance-ii-wbtc-zapper-approves-exchange) - [WBTCZapper precision loss will lead to reverts](https://0xsimao.com/findings/evro-finance-ii-wbtc-zapper-precision-reverts) - [API3 oracle future timestamp causes temporary DoS via underflow](https://0xsimao.com/findings/evro-finance-ii-oracle-timestamp-temporary-underflow) ### Low - [SDAIPriceFeed missing constructor price feed check](https://0xsimao.com/findings/evro-finance-ii-sdai-price-feed-constructor) - [IWBTCZapper interface mismatches implementation](https://0xsimao.com/findings/evro-finance-ii-iwbtc-zapper-mismatches-implementation) - [TroveNFT Duplicates ERC721Enumerable Logic](https://0xsimao.com/findings/evro-finance-ii-trove-duplicates-erc721-enumerable) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-12-26-evro-finance-ii.pdf)