# Yieldoor LoopedVault audit 0xSimao · Leveraged yield farming · 20th June 2025 A private security review of Yieldoor (leveraged yield farming), conducted solo and completed on 20th June 2025 over 2 days. 0xSimao disclosed 5 findings: 2 medium, 2 low and 1 informational. ## What Yieldoor is Yieldoor is a leveraged yield farming protocol: vaults run concentrated liquidity positions on CLMM DEXes, a lending pool funds the leverage traders draw, and gauge contracts vest strategy rewards to depositors over time rather than at once. ## Scope The second solo round covered the LoopedVault: an ERC-4626 vault that loops deposits through external money markets, Aave and Morpho among them, to lever a yield position, with an allocator bot fulfilling requested withdrawals and rebalance callbacks moving debt between venues. ## Medium severity findings - [Vesting interest is not reset to 0 in case there is no interest in LoopedVault11::updateTotalAssets()](https://0xsimao.com/findings/yieldoor-ii-vesting-interest-reset-vault11) - [Code has typos in RebalanceLogic::repayAavePosition() leading to undefined behaviour](https://0xsimao.com/findings/yieldoor-ii-repay-aave-undefined-behaviour) ## Low severity findings - [RebalanceLogic::rebalanceCallback() doesn't update lastTotalAssets when rebalancing from morpho to morpho](https://0xsimao.com/findings/yieldoor-ii-rebalance-callback-rebalancing-morpho) - [Inconsistent updateTotalAssets modifier usage](https://0xsimao.com/findings/yieldoor-ii-inconsistent-assets-modifier-usage) ## Informational findings - [Duplicated approval in RebalanceLogic::rebalanceCallback()](https://0xsimao.com/findings/yieldoor-ii-duplicated-approval-rebalance-callback) ## The report [Download the report (PDF)](https://0xsimao.com/reports/2025-06-20-yieldoor-ii.pdf)