Security Testing Report for R25's SyncVault Contracts

The target of this audit is the private code repository of SyncVault Contracts of R25. The SyncVault contracts form an upgradeable tokenized asset vault system within R25. Following a synchronous redemption model, SyncVault issues time-locked shares upon deposit and processes redemptions either immediately within configured limits or through a queued flow for deferred fulfillment. Throughout this module, deposited assets are forwarded to a custodian address, withdrawals are funded by a dedicated payer account, and vault instances are deployed and tracked by a factory contract. Specifically, for code in Version 1, the audit only focuses on the smart contracts in the following directories/files: src/r25-pc For code in Version 2, the audit only focuses on the smart contracts in the following directories/files: src/r25-pc/SyncVault Other files are not within the scope of the audit. Additionally, all dependencies of the Target are considered reliable in terms of both functionality and security, and are therefore not included in the audit scope.

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we did not find any critical issues within the audited codebase. However, we have identified some non-critical issues that should be addressed. Additionally, we have put forth recommendations and notes that should be taken into consideration. It is important to note that the scope of our audit was strictly limited to the specific code versions mentioned in the report. Any updates made subsequent to our review would require a re-evaluation.