Yieldoor LoopedVault audit
A private security review of Yieldoor (leveraged yield farming), conducted solo and completed on 20th June 2025 over 2 days. 0xSimao disclosed 5 findings: 2 medium, 2 low and 1 informational.
What Yieldoor is
Yieldoor is a leveraged yield farming protocol: vaults run concentrated liquidity positions on CLMM DEXes, a lending pool funds the leverage traders draw, and gauge contracts vest strategy rewards to depositors over time rather than at once.
Scope
The second solo round covered the LoopedVault: an ERC-4626 vault that loops deposits through external money markets, Aave and Morpho among them, to lever a yield position, with an allocator bot fulfilling requested withdrawals and rebalance callbacks moving debt between venues.
Medium severity findings
- Vesting interest is not reset to 0 in case there is no interest in LoopedVault11::updateTotalAssets()
- Code has typos in RebalanceLogic::repayAavePosition() leading to undefined behaviour
Low severity findings
- RebalanceLogic::rebalanceCallback() doesn't update lastTotalAssets when rebalancing from morpho to morpho
- Inconsistent updateTotalAssets modifier usage
Informational findings
The report