# Yieldoor Gauges audit 0xSimao · Leveraged yield farming · 12th May 2025 A private security review of Yieldoor (leveraged yield farming), conducted solo and completed on 12th May 2025 over 2 days. 0xSimao disclosed 8 findings: 1 medium, 5 low and 2 informational. ## What Yieldoor is Yieldoor is a leveraged yield farming protocol: vaults run concentrated liquidity positions on CLMM DEXes, a lending pool funds the leverage traders draw, and gauge contracts vest strategy rewards to depositors over time rather than at once. ## Scope This first solo round centred on the reward path for Shadow and Ramses-style gauges: ShadowStrategyGauge holds the strategy's staked position, collects emissions, and vests them to vault depositors, with fees taken on the way through. ## Medium severity findings - [Fees or vested position withdrawal in ShadowStrategyGauge::addVestingPosition() when collecting fees will be revested](https://0xsimao.com/findings/yieldoor-i-fees-withdrawal-vesting-revested) ## Low severity findings - [DoS risk in IRamsesGauge(gauge).getReward() when enough periods have passed](https://0xsimao.com/findings/yieldoor-i-risk-ramses-reward-periods) - [Newly added rewards will not be immediately collected](https://0xsimao.com/findings/yieldoor-i-newly-rewards-immediately-collected) - [ShadowStrategyGauge::addVestingPosition() may revert if there is 0 liquidity to add](https://0xsimao.com/findings/yieldoor-i-shadow-gauge-vesting-revert) - [If any of the reward tokens doesn't have a liquid pool, it may be impossible to collect rewards](https://0xsimao.com/findings/yieldoor-i-reward-liquid-impossible-rewards) - [Swap amount can be 0 as it divides the balance by 2, DoSing ShadowStrategyGauge::collectGaugeRewards()](https://0xsimao.com/findings/yieldoor-i-divides-sing-shadow-rewards) ## Informational findings - [If enough rebalances are performed, ShadowStrategyGauge::collectGaugeRewards() could be DoSed](https://0xsimao.com/findings/yieldoor-i-rebalances-performed-shadow-rewards) - [If xShadow is token0 or token1, ShadowStrategyGauge::collectGaugeRewards() will take protocol fee on user funds](https://0xsimao.com/findings/yieldoor-i-token0-token1-rewards-fee) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-05-12-yieldoor-i.pdf)