# Nerite audit Sherlock · CDP stablecoin · 3rd February 2025 A private security review of Nerite (CDP stablecoin), conducted with Sherlock and completed on 3rd February 2025 over 15 days. 0xSimao disclosed 3 findings: 1 medium and 2 low. ## What Nerite is Nerite is a CDP stablecoin on Arbitrum built on Liquity v2: users open troves against multiple collateral types to mint USND, interest rates are user-set with redemptions ordering risk, and a stability pool backstops liquidations. ## Scope The Sherlock review covered the NeriteOrg/nerite repository, Liquity v2's machinery under Nerite's parameters and collateral onboarding, with attention on initialisation, token wiring and the paths where pausable or blacklistable collaterals meet liquidation flows. ## Medium severity findings - [`BoldToken` initialization can be frontrun to silently mint/approve bold to an attacker](https://0xsimao.com/findings/nerite-initialization-frontrun-mint-approve) ## Low severity findings - [New debt from adjusted trove is double counted towards the limit](https://0xsimao.com/findings/nerite-debt-adjusted-counted-towards) - [Pausable or Blacklist tokens may cause liquidations to fail](https://0xsimao.com/findings/nerite-pausable-blacklist-liquidations-fail) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-02-03-nerite.pdf)