Kann Audits
View Audits Talk to an Expert

Kann Audits / Security Review

Gluon

Gluon Yield Aggregator Security Review

Review of the Forwarder strategy’s vault-deposit validation and fund-deployment logic.

SoliditySeptember 19, 2025
Download Report Open Report
Audit period
September 19, 2025
Researchers
3 listed
Scope
1 scoped path
Technologies
Solidity
Findings
2 documented

Executive summary

What was reviewed

Review of the Forwarder strategy’s vault-deposit validation and fund-deployment logic.

This page reflects only the scope and review context disclosed in the published report. Fields the report does not provide are omitted rather than inferred; the PDF remains the source of record for issue detail and limitations.

Security is contextual. This report does not guarantee that the protocol is free from vulnerabilities. It applies to the review context documented in the report.

Scope & record

Engagement dossier

Researchers
Kann, Radev_eth, Fitro
Technologies
Solidity
Category
Yield Aggregator

Files and paths in scope

  • /src/Forwarder.sol

Findings overview

Severity distribution

The counts below are transcribed from the published report. Status and issue detail remain subject to that report’s exact terminology.

FINDINGS02Documented in the published report
Medium: 1Informational: 1
SeverityCount
Critical0
High0
Medium1
Low0
Informational1

Published findings

Findings

Findings below are reproduced from the complete Kann Audits security review. View the full PDF for complete scope, methodology, assumptions, and audit context.

Medium

1 finding
4.1.1

Missing Validation of deposit to targetvault Return Value

Medium
Description

The _deployFunds function forwards funds to targetVault by calling: targetVault.deposit(deployAmount, address(this)); The _deployFunds function assumes targetVault.deposit(...) will always give the strategy a non-zero amount of vault shares. In normal, well-behaved vaults that’s true, but there are cases where this assumption can fail. For example, if a freshly launched/integrated vault has been pre-funded (someone transfers assets directly to the vault contract without calling transfer the vault’s share-calculation can be skewed and a subsequent deposit call can result in 0 shares minted for the depositor. Other edge cases could also lead to the same outcome, leaving the strategy’s assets effectively locked in the vault with no credited shares. Recommendation Always validate that shares were actually received: uint256 sharesReceived = targetVault.deposit(deployAmount, address(this)); require(sharesReceived > 0, "Deposit did not mint shares");

Resolution

Fixed 4.2 Informational

StatusFixed

Link to this finding

Informational

1 finding
4.2.1

Redundant Balance Check and Math.min in deployFunds

Informational
Description

A user calls deposit() This function is defined in TokenizedStrategy and is executed via delegatecall from the Forwarder (which inherits BaseStrategy). As a result, storage updates happen in the Forwarder, msg.sender remains the user, and address(this) refers to the Forwarder. Inside TokenizedStrategy.deposit: Assets are transferred from the user to the Forwarder (_asset.safeTransferFrom(msg.sender,address(this),assets)). thenIBaseStrategy(address(this)).deployFunds( _asset.balanceOf(address(this)) ); We call deployFunds with the balance of the forwarder = BaseStrategywheretheninsideForwarderitgetsuint256deployAmount=Math.min(_amount, balance); Which both values are same since _amount is address this balance of asset and balance is address(this) balance of the asset in the contract. Math.min and getting the balance of the contract in _deployFunds is redudant.

StatusFixed

Link to this finding

Methodology

How Kann Audits reviews code

Kann Audits reports describe independent researcher review followed by collaborative analysis of findings and attack paths. The standard review foundation includes:

  1. 01Architecture and trust-boundary analysis
  2. 02Independent manual review
  3. 03State-transition and invariant analysis
  4. 04Access-control and integration review
  5. 05Adversarial testing and attack-path analysis
  6. 06Fix verification and regression review

Audit team

Researchers listed in the report

KannRadev_ethFitro

Final assessment

Documented outcome

Both reported findings were marked fixed.

The assessment applies only to the review context and limitations documented in the published report. Missing details are not inferred, and later changes require separate analysis.

Download Full PDF Open Report Explore Smart Contract Security Audits

Continue reading

More public work connected by protocol, category, chain, or technology.

All reports

Start a conversation

Planning your next release?

Share the system, fixed scope, and target date. Build enough time into the plan for review, remediation, and verification.

Talk to an Expert View Audits