Security Testing Report for R25's AsyncVault Contracts

The target of this audit is the private code repository of AsyncVault Contracts of R25. The AsyncVault contracts are an upgradeable tokenized asset vault system of R25. AsyncVault follows an asynchronous redemption model, where deposits mint time-locked shares and redemptions proceed through a request-based flow that is settled after maturity, with withdrawal fulfillment handled through a separate queue component. Across this module, deposited assets are forwarded to a custodian address, withdrawals are funded by a separate payer account through the queue, and vault instances are created and tracked by the factory.

Please refer to the report for the detailed audit scope.

Our audit methodology employs automated vulnerability scans, manual verification, and business logic analysis to uncover potential security issues coupled with gas and code quality optimization recommendations.

In summary, we did not find any critical issues within the audited codebase. However, we have identified some non-critical issues that should be addressed. Additionally, we have put forth recommendations and notes that should be taken into consideration. It is important to note that the scope of our audit was strictly limited to the specific code versions mentioned in the report. Any updates made subsequent to our review would require a re-evaluation.