yAudit Contact
Reports

Smart Contract Security Assessment

Twyne account check removal

Twyne is a credit delegation protocol that lets borrowers rent unused borrowing power from other lenders to boost their Liquidation LTV. Lenders earn additional yield while borrowers get to ramp up their leverage or insulate their debt.

2
Issues
0
C/H/M
Period
Dec 16, 2025 - Dec 16, 2025
Auditors
Adriro, HHK

Review Summary

Protocol Overview

Twyne is a credit delegation protocol that lets borrowers rent unused borrowing power from other lenders to boost their Liquidation LTV. Lenders earn additional yield while borrowers get to ramp up their leverage or insulate their debt.

Protocol
Twyne
Timeline
Dec 16, 2025 - Dec 16, 2025
Audit Team
Adriro, HHK
Source
yAudit/twyne-account-check-removal

Audit Overview

Scope and Resources

github.com/0xTwyne/twyne-contracts PR#200 PR#212

Scope

This audit covers 2 pull requests totaling approximately 81~ lines of code across 1 day of review.

Overall Assessment

Evaluation Matrix

access control

mathematics

complexity

libraries

decentralization

code stability

documentation

monitoring

testing

Key Findings

Findings Summary

0
Critical
0
High
0
Medium
0
Low
1
Informational
1
Gas
Ref Severity Title
I-1 Informational Use caller instead of receiver in BridgeHookTarget
G-1 Gas Replace `requireAccountAndVaultStatusCheck()` with `requireVaultStatusCheck`
I-1 Finding

I-1: Use caller instead of receiver in BridgeHookTarget

Informational

Description:

Currently, the implementation of BridgeHookTarget checks that the receiver is a collateral vault during a borrow operation.

22:     function borrow(uint /*amount*/, address receiver) external view {
23:         require(collateralVaultFactory.isCollateralVault(receiver), ReceiverNotCollateralVault());
24:     }

Given the changes in pull requests #200 and #212, it would be safer to enforce the condition on the actual caller.

Impact:

Informational.

Recommendation:

Consider enforcing the condition on the original caller instead of the receiver.

Developer Response:

G-1 Finding

G-1: Replace `requireAccountAndVaultStatusCheck()` with `requireVaultStatusCheck`

Gas

Description:

PR#212 and PR#200 remove checkLiquidity() inside the EVK's intermediate vault implementation during checkAccountStatus().

Since collateral vault account status checks on the intermediate vaults will always succeed, only vault status checks are required.

Impact:

Gas savings.

Recommendation:

Replace requireAccountAndVaultStatusCheck() with requireVaultStatusCheck() throughout the collateral vault implementations.

Developer Response:

Fixed in PR#216.

Final Remarks

This review focused on PR#200 and PR#212 of the Twyne codebase. The PRs introduce a change to the intermediate vault EVK's implementation by removing the liquidity check inside checkAccountStatus(). This allows the collateral vault to potentially borrow over 100% of the collateral for future use cases, delegating invariants and security checks to the collateral vault implementation. The review did not result in any medium or above severity findings, highlighting the seriousness of the Twyne team.

Methodology

Severity Classification

Critical

Immediate threat to user funds or protocol integrity

Direct loss of funds, protocol compromise

High

Significant security risk requiring urgent attention

Potential fund loss, major functionality disruption

Medium

Important issue that should be addressed

Limited fund risk, functionality concerns

Low

Minor issue with minimal impact

Best practice violations, minor inefficiencies

Gas

Findings that improve gas efficiency

Increased transaction costs

Informational

Code quality and best practice recommendations

Reduced maintainability and readability