Yieldoor audit contest
A public audit contest on Sherlock (CLMM), completed on 24th February 2025. 0xSimao placed #1. 12 of his findings are published: 3 high severity and 9 medium.
What Yieldoor is
Yieldoor is a leveraged yield farming protocol: vaults run concentrated liquidity positions on CLMM DEXes, a lending pool funds the leverage traders draw, and reward gauges vest strategy income to depositors.
Scope
The Sherlock competition covered the vault and leverager pair: deposit pricing against pool slot0, leverage limits and liquidation thresholds, and the borrow accounting between the leverager and the lending pool.
High severity findings
- Strategy main ticks are set according to the tick in slot0, leading to incorrect allocation and loss of funds
- Base calculation in
Leverager::isLiquidateable()is incorrect as the max leverage may be smaller - Contradiction between high-leverage and liquidation check of position
Medium severity findings
Vault::_calcDeposit()will overflow for low priced tokensLeverager::deposit, does not support multi-hop swaps withexactOutputReserveLogic::_updateIndexes()assumes the utilization rate was constant the whole time when calculating the new borrows- Strategy main ticks are not symmetric when the tick spacing is one due to incorrect isLowerSided inequality
Strategy::checkPoolActivity()incorrect check leads to vulnerable priceStrategy::checkPoolActivity()does not look as far back as it should- Incorrect modulo calculation in secondary position ticks leads to active position and division by zero
Vault::withdraw()withdraws too much liquidity leading to idle capital and loss of fees- Locked funds due to underflow in withdrawal
The contest