Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Avantis>Low findings>The ,maxRedeem, function should comply with ERC-4626
GeneralOverview
Findings
Critical (6)
High (9)
Medium (6)
Low (10)Miscalculation of `totalPrincipalDeposited`Fee charged without market-order placementOne account can register multiple referral codesVault manager cannot access entire junior trancheThe maxRedeem function should comply with ERC-4626Incorrect access control causes update lockoutTrader contract can bypass max trades per pairLimit-order timelock not initialized on openPartial closes emit incorrect valueFunction lacks incorrect-payment sanity checks
Informational (7)
DiscussionReferral code incentives are misalignedVeTranche NFT info should be structNo way to remove user from Trading whitelistPyth price can become negative or erraticTranche has unnecessary `ReentrancyGuard`Checks-effects-interactions pattern brokenTypos
Threat ModelWhat are threat models?Execute.solReferral.solTrading.solTradingStorage.solTranche.solVaultManager.solVeTranche.sol
Audit ResultsSummary
Category: Protocol Risks

The maxRedeem function should comply with ERC-4626

Low Severity
Low Impact
Medium Likelihood

Description

Tranche should be an ERC-4626--compliant contract. In the ERC-4626 specification, the maxRedeem function should return the maximum amount of shares that can be redeemed, keeping in mind all redemption limits.

One of the redemption limits that apply to withdrawals is the utilization ratio reserve requirement. Since maxRedeem is currently not overridden from the underlying ERC-4626 contract, it doesn't consider this requirement, and it needs to be aware of this limit to adjust the return value down if applicable.

Impact

Other contracts or external front-ends expecting ERC-4626 compliance can unexpectedly revert.

Recommendations

Override maxRedeem with an implementation that considers the reserve ratio requirement.

Remediation

This issue has been acknowledged by Avantis Labs, Inc., and fixes were implemented in the following commits:

Zellic © 2025Back to top ↑