# Yieldoor audit contest Sherlock · CLMM · 24th February 2025 · #1 A public audit contest on Sherlock (CLMM), completed on 24th February 2025. 0xSimao placed #1. 12 of his findings are published: 3 high severity and 9 medium. ## What Yieldoor is Yieldoor is a leveraged yield farming protocol: vaults run concentrated liquidity positions on CLMM DEXes, a lending pool funds the leverage traders draw, and reward gauges vest strategy income to depositors. ## Scope The Sherlock competition covered the vault and leverager pair: deposit pricing against pool slot0, leverage limits and liquidation thresholds, and the borrow accounting between the leverager and the lending pool. ## High severity findings - [Strategy main ticks are set according to the tick in slot0, leading to incorrect allocation and loss of funds](https://0xsimao.com/findings/yieldoor-main-according-slot0-allocation) - [Base calculation in `Leverager::isLiquidateable()` is incorrect as the max leverage may be smaller](https://0xsimao.com/findings/yieldoor-leverager-liquidateable-leverage-smaller) - [Contradiction between high-leverage and liquidation check of position](https://0xsimao.com/findings/yieldoor-contradiction-high-leverage-liquidation) ## Medium severity findings - [`Vault::_calcDeposit()` will overflow for low priced tokens](https://0xsimao.com/findings/yieldoor-calc-deposit-overflow-priced) - [`Leverager::deposit`, does not support multi-hop swaps with `exactOutput`](https://0xsimao.com/findings/yieldoor-deposit-hop-exact-output) - [`ReserveLogic::_updateIndexes()` assumes the utilization rate was constant the whole time when calculating the new borrows](https://0xsimao.com/findings/yieldoor-constant-whole-calculating-borrows) - [Strategy main ticks are not symmetric when the tick spacing is one due to incorrect isLowerSided inequality](https://0xsimao.com/findings/yieldoor-symmetric-spacing-sided-inequality) - [`Strategy::checkPoolActivity()` incorrect check leads to vulnerable price](https://0xsimao.com/findings/yieldoor-activity-incorrect-vulnerable-price) - [`Strategy::checkPoolActivity()` does not look as far back as it should](https://0xsimao.com/findings/yieldoor-activity-look-far-back) - [Incorrect modulo calculation in secondary position ticks leads to active position and division by zero](https://0xsimao.com/findings/yieldoor-modulo-secondary-division-zero) - [`Vault::withdraw()` withdraws too much liquidity leading to idle capital and loss of fees](https://0xsimao.com/findings/yieldoor-withdraw-withdraws-capital-fees) - [Locked funds due to underflow in withdrawal](https://0xsimao.com/findings/yieldoor-locked-funds-underflow-withdrawal) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/791)