yAudit Contact
Reports

Smart Contract Security Assessment

Twyne AAVE deployment script

Twyne is a credit delegation protocol that lets borrowers rent unused borrowing power from other lenders to boost their Liquidation LTV. Lenders earn additional yield while borrowers get to ramp up their leverage or insulate their debt.

4
Issues
0
C/H/M
Period
Dec 12, 2025 - Dec 12, 2025
Auditors
Adriro, HHK

Review Summary

Protocol Overview

Twyne is a credit delegation protocol that lets borrowers rent unused borrowing power from other lenders to boost their Liquidation LTV. Lenders earn additional yield while borrowers get to ramp up their leverage or insulate their debt.

Protocol
Twyne
Timeline
Dec 12, 2025 - Dec 12, 2025
Audit Team
Adriro, HHK
Source
yAudit/twyne-aave-deployment-script

Audit Overview

Scope and Resources

github.com/0xTwyne/twyne-contracts 2302748618

Scope

This audit covers 1 contract totaling approximately 250~ lines of code across 1 day of review.

Overall Assessment

Evaluation Matrix

access control

mathematics

complexity

libraries

decentralization

code stability

documentation

monitoring

testing

Key Findings

Findings Summary

0
Critical
0
High
0
Medium
1
Low
3
Informational
0
Gas
Ref Severity Title
L-1 Low Incorrect JSON key in the deployment output
I-1 Informational Unused Oracle variable in TwyneDeployAaveV3Integration
I-2 Informational Incorrect comments in deployment of utilization configuration
I-3 Informational Consider removing the fallback Oracle
L-1 Finding

L-1: Incorrect JSON key in the deployment output

Low

Description:

The phase 0 uses the upgrBeacon key to store the beacon address, while phase 1 uses the upgradeableBeacon key to retrieve it.

Impact:

Low.

Recommendation:

Use the same key.

Developer Response:

Fixed in PR#217.

I-1 Finding

I-1: Unused Oracle variable in TwyneDeployAaveV3Integration

Informational

Description:

The oracleRouter variable is not used in the script.

Impact:

Informational.

Recommendation:

Remove the variable to avoid confusion with the Oracle deployed in the run.

Developer Response:

Fixed in PR#217.

I-3 Finding

I-3: Consider removing the fallback Oracle

Informational

Description:

The TwyneDeployAaveV3Integration script sets up the AaveV3ATokenWrapperOracle as the fallback Oracle in the Router, which is not necessary for the deployed infrastructure.

313:         // Set aave wrapper token oracle as fallback oracle on oracle router
314:         bytes memory oracleSetData = abi.encodeCall(EulerRouter.govSetFallbackOracle, (address(aTokenWrapperOracle)));
315:         bytes memory vaultManagerCall = abi.encodeCall(vaultManager.doCall, (address(aaveOracleRouter), 0, oracleSetData));
316:         addToBatch(address(vaultManager), vaultManagerCall);

Impact:

Informational.

Recommendation:

Consider removing the fallback Oracle if it isn't strictly needed.

Developer Response:

Acknowledged.

Final Remarks

This review focused on the AAVE deployment script of the Twyne codebase. The review did not result in any medium or above severity findings. However, minor issues potentially blocking the deployment were uncovered but quickly fixed, highlighting the seriousness of the Twyne team.

Methodology

Severity Classification

Critical

Immediate threat to user funds or protocol integrity

Direct loss of funds, protocol compromise

High

Significant security risk requiring urgent attention

Potential fund loss, major functionality disruption

Medium

Important issue that should be addressed

Limited fund risk, functionality concerns

Low

Minor issue with minimal impact

Best practice violations, minor inefficiencies

Gas

Findings that improve gas efficiency

Increased transaction costs

Informational

Code quality and best practice recommendations

Reduced maintainability and readability