Yieldoor LoopedVault Update audit
A private security review of Yieldoor (leveraged yield farming), conducted solo and completed on 23rd June 2025 over 4 days. 0xSimao disclosed 7 findings: 7 low.
What Yieldoor is
Yieldoor is a leveraged yield farming protocol: vaults run concentrated liquidity positions on CLMM DEXes, a lending pool funds the leverage traders draw, and gauge contracts vest strategy rewards to depositors over time rather than at once.
Scope
The third solo round returned to the LoopedVault after the second round's fixes: the request-and-fulfill withdrawal flow between users and the allocator bot, share accounting when mint and redeem are overridden, and the vault's behaviour when its Aave or Morpho debt cannot be unwound cleanly.
Low severity findings
- Missing nonReentrant functionality in some execution paths
- It's possible for debt to be stuck in the LoopedVault when rebalancing from Aave to Morpho
- CEI pattern is not followed on LoopedVault::fulfillWithdraw()
- Slippage protection could be added to LoopedVault::requestWithdraw() in case of black swan event
- Missing key events when requesting withdrawals that could be important for the allocator bot
- LoopedVault::maxMint() and LoopedVault::maxRedeem() are not overriden
- User may be requesting/fulfilling withdrawals at better rates than the real share/asset ratio
The report