Spectra MetaVault Bridge audit
A private security review of Spectra MetaVault (yield-tokenisation vaults), conducted with Sherlock and completed on 16th December 2025 over 3 days. 0xSimao disclosed 8 findings: 4 low and 4 informational.
What Spectra is
Spectra tokenises yield: principal and yield tokens split an interest-bearing deposit, and MetaVaults curate those positions for depositors. Moving a MetaVault position between chains runs through bridge zaps, with a gatekeeper deciding what an arriving message may do.
Scope
The December update covered the bridge layer: the CCTP and DeBridge zap adapters, the BridgeGatekeeper in front of them and the MetavaultsRegistry that says which vaults a bridged deposit may enter.
Low severity findings
- nativeFeeProvided < totalNativeRequired check in BridgeDeBridge::bridgeDeBridgeWithFee is incorrect
- Possible mistake in the unregister by index functions
MetavaultsRegistry::registerChain()allows chain id 0, which doesn't exist, but would be problematicMetavaultsRegistry::removeBridgePathByIndex()is missing
Informational findings
- Struct order in MetavaultsRegistry could be switched for better readability
- address(0) check could be added to
MetavaultRegistry::registerMetavault() - Some variable shadowing in MetavaultsRegistry
MetavaultsRegistry::registerMarket()/allowBridgePath()duplicateonlyRegisteredmodifier
The report