Cian Protocol | Ethereum | Submission Review by BowtiedRahman · Pull Request #180 · deficollective/defiscan

BowtiedRahman · 2025-06-01T19:44:00Z

This is my first draft submission, This is a draft so things may need ironing out

vercel · 2025-06-01T19:44:04Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Comments	Updated (UTC)
defiscan	Ready	Preview	Comment	Sep 13, 2025 2:33pm

BowtiedRahman · 2025-06-05T20:55:51Z

I you people are super busy but I'm still awaiting feedback on the draft submission to finalize the final review

yvesbou · 2025-06-06T13:39:22Z

@BowtiedRahman yes I started, but havent finished my review yet. Thanks for your patience!

BowtiedRahman · 2025-06-11T12:48:59Z

Just checking in, I know you're super busy but it's been five days and no update whatsoever. Thanks for your understanding

yvesbou · 2025-06-11T20:44:43Z

@BowtiedRahman sorry for the delay, I realised that a couple of contracts are missing - I want to come back with helpful advise how to continue further research.

BowtiedRahman · 2025-06-14T22:54:18Z

@yvesbou I only focused on Ethereum in this review. The contracts you mentioned I missed, are they on ethereum?

yvesbou · 2025-06-15T11:32:24Z

Hi @BowtiedRahman sorry again for the delay

I looked more into the report and noticed the report is scoped correctly for "Cian Automation" but misses contracts in the permissions section and explanations on protocol mechanism for "Cian Yield Layer".

I think the confusion comes from the fact that this link https://docs.cian.app/resources/contracts/yield-layer lists the Yield layer contracts, but at the same time, in the very bottom, lists the "Cian Automation" and calls it Mainnet Flagship Vault. (when interacting with https://dapp.cian.app/strategy/stethls/create). I interacted with the protocol through this frontend and through tx analysis I found that I interacted with the automation contracts.

Yield Layer has much more TVL than the single strategy on automation, so the report should focus on the Yield Layer only.

In the original scope, it included for each vault

Vault Proxy and Implementation
Manager
Strategies

As it was already correctly pointed out in our discord, re-assessing the impact of the the common interfaces within the strategies is not necessary, but we do want the contracts section to show all the contracts that are assessed for a report. So please dont remove the contracts. In the Reviewer Notes a remark on Strategy contracts that share the same interface can be made.

In terms of coverage we want the following vaults, alongside Strategies, Operator and Manager contracts to be covered

stETH (0xB13aa2d0345b0439b064f26B82D8dCf3f508775d)
rsETH (0xd87a19fF681AE98BF10d2220D1AE3Fbd374ADE4e)
BTCLst (0x6c77bdE03952BbcB923815d90A73a7eD7EC895D1)
FBTC (0x9fdDAD44eD6b77e6777dC1b16ee4FCcCBaF0A019)

And to emphasize again, we dont want the permission table to have multiple rows for each strategies if they are the same, if it works the common denominator once + what each strategy has uniquely to them as centralization vector, but all contracts that are used in the protocol shall be listed in the contracts section.

yvesbou · 2025-06-15T11:35:24Z

If you allow me to push the scanner output to your branch (did it locally already), you can focus on assessing impact + consolidating the unique permissions that exist. I also drew myself the Yield Layer architecture a bit, I copied it to the shared excalidraw.

BowtiedRahman · 2025-06-15T13:13:11Z

I'd very much like you to share the scanner output. Also can you elaborate more on which section(s) of the review I need to write again.

yvesbou

I will post scanner results of the remaining vaults later. I posted the results just at the bottom, feel free to re-use some of the impact you wrote already.

src/content/protocols/Cian.md

yvesbou · 2025-06-15T15:24:30Z

@BowtiedRahman focus first on the permissions and impact, and seeing differences between the strategies, before writing the overview rating section

emduc · 2025-07-14T21:18:29Z

Well noted. Thanks for pushing the changes, give us some time and we'll get back to you

BowtiedRahman · 2025-08-03T15:00:51Z

@emduc @yvesbou It's been three weeks since you said you'll get back to me, how long is the review going to take?

BowtiedRahman · 2025-08-04T10:08:50Z

@emduc @yvesbou It's been three weeks since you said you'll get back to me, how long is the review going to take?

BowtiedRahman · 2025-08-05T08:48:25Z

@emduc @brianmcmichael @yvesbou Can I have a date for the final submission?

BowtiedRahman · 2025-08-11T13:49:36Z

Is the submission still being reviewed? @emduc @yvesbou @brianmcmichael @nbundi

emduc · 2025-08-11T13:55:40Z

Hi @BowtiedRahman

By pinging us on all possible platforms, you're missing our replies...
We replied on both public and private discord channels that we are currently busy with several reviews and have limited throughput. We will get back to you as soon as possible, most likely in about a week. If you have concerns or are pressed for different reasons, please let us know.

BowtiedRahman · 2025-08-12T13:04:13Z

I understand the team is busy with multiple reviews but it's been a MONTH with no feedback since I submitted the final review which includes the fixes suggested in the draft submission, hence my multiple pings. I'm happy to wait

yvesbou

hi @BowtiedRahman - please fix the requested changes

yvesbou · 2025-08-27T04:38:41Z

src/content/protocols/Cian.md

+
+| Name          | Account | Type     | ≥ 7 signers | ≥ 51% threshold | ≥ 50% non-insider | Signers public |
+| ------------- | ------- | -------- | ----------- | --------------- | ----------------- | -------------- |
+| Undeclared Multisig | [0x261090afE1E7305474F4e3eEFCAca9964eBffFf5](https://etherscan.io/address/0x261090afE1E7305474F4e3eEFCAca9964eBffFf5)  | Multisig | ✅          | ❌              | ❌                | ✅             |


Suggested change

| Undeclared Multisig | [0x261090afE1E7305474F4e3eEFCAca9964eBffFf5](https://etherscan.io/address/0x261090afE1E7305474F4e3eEFCAca9964eBffFf5) | Multisig | ✅ | ❌ | ❌ | ✅ |

| Owner YlstETH (undeclared) | [0x261090afE1E7305474F4e3eEFCAca9964eBffFf5](https://etherscan.io/address/0x261090afE1E7305474F4e3eEFCAca9964eBffFf5) | Multisig | ❌ | ✅ | ❌ | ❌ |

the owner is a 3-of-4-multisig, first column is not a tick (✅) but a cross (❌)

please add all owners into this table that are not contracts

Name Account Type

Vault Owner 0x8FA9aa69a6e94c1cd49FbF214C833B2911D02553 EOA

Operator 0x994Cc8Ef6aC289d0016dC28E691CF75eaE4e776b Contract

Rebalancer 2 (YlstETH) 0x7c0393F1CF1faf3106478960bEf21635Ff6182C4 Multisig

Rebalancer 2 (YlrsETH) 0x20E5737D4B888154c8220304310aBb8b63881D2a Multisig

FeeReceiver 0xc554747ffde2e378a562a09f2f72f4121C1d493D EOA

Owner (YlrsETH) 0x0b5d3121E144cf1410850c9608651a039BFd543e Multisig

Owner (YlBTCLST) 0x28784DbF1DA93da28873c9f4A8B471D64A11FCfd Multisig

please add all owners into this table that are not contracts
Name Account Type
Vault Owner 0x8FA9aa69a6e94c1cd49FbF214C833B2911D02553 EOA
Operator 0x994Cc8Ef6aC289d0016dC28E691CF75eaE4e776b Contract
Rebalancer 2 (YlstETH) 0x7c0393F1CF1faf3106478960bEf21635Ff6182C4 Multisig
Rebalancer 2 (YlrsETH) 0x20E5737D4B888154c8220304310aBb8b63881D2a Multisig
FeeReceiver 0xc554747ffde2e378a562a09f2f72f4121C1d493D EOA
Owner (YlrsETH) 0x0b5d3121E144cf1410850c9608651a039BFd543e Multisig
Owner (YlBTCLST) 0x28784DbF1DA93da28873c9f4A8B471D64A11FCfd Multisig

Do you mean in the permissions owner section? if so, none of them are contracts @yvesbou

We have one table called Permission Owners, here permission owners are just listed without ✅/❌ qualifications of security council requirements - then we have a security council table where we list all multisigs and evaluate them in security council requirements. @BowtiedRahman

src/content/protocols/Cian.md

Co-authored-by: Yves Boutellier <63062257+yvesbou@users.noreply.github.com>

BowtiedRahman · 2025-08-31T20:18:31Z

Is this the final review?

Co-authored-by: Yves Boutellier <63062257+yvesbou@users.noreply.github.com>

BowtiedRahman · 2025-09-13T14:37:41Z

@yvesbou I've pushed all fixes and corrections, kindly review it for any corrections.

BowtiedRahman · 2025-09-16T16:23:19Z

Hi @yvesbou, @emduc, @brianmcmichael, and @nbundi, I submitted my fixes for the Cian Yield layer review four days ago, yet I have received no response from the team. Could I please inquire when the fixes will be reviewed and finalized? I've been working on this report for three months now, and I'd really like it to be finalized. Thanks for your understanding.

yvesbou · 2025-09-16T17:51:52Z

Hi @BowtiedRahman,
I cannot give a definitive answer to this, I assume we have feedback by end of week, and it will at most two further iterations, I expect one.

BowtiedRahman · 2025-09-24T19:55:55Z

Hi @yvesbou I'm yet again inquiring about the review of the recent fixes or if possible when you will be done reviewing it.

yvesbou · 2025-09-30T11:29:47Z

src/content/protocols/Cian.md

+## Upgradeability
+
+
+The Cian Yield Layer is upgradable allowing for the updates of all vaults (`YlFBTC`, `YlBTCLst`, `YlrsETH`, `YlstETH`) and their associated strategy contracts which are adapters to the yield sources. This can result in the _loss of funds_ or _loss of unclaimed yield_ as well as lead to other changes in the expected performance of the protocol. 


Suggested change

The Cian Yield Layer is upgradable allowing for the updates of all vaults (`YlFBTC`, `YlBTCLst`, `YlrsETH`, `YlstETH`) and their associated strategy contracts which are adapters to the yield sources. This can result in the _loss of funds_ or _loss of unclaimed yield_ as well as lead to other changes in the expected performance of the protocol.

The Cian Yield Layer is upgradable allowing for the updates of all vaults (`YlFBTC`, `YlBTCLst`, `YlrsETH`, `YlstETH`) and their associated strategy contracts which are adapters to 3rd party protocols such as Aave or Lido which serve as yield sources. This can result in the _loss of funds_ or _loss of unclaimed yield_ as well as lead to other changes in the expected performance of the protocol.

yvesbou · 2025-09-30T11:31:50Z

src/content/protocols/Cian.md

+
+## Security Council
+
+New table with all the multisigs


Suggested change

New table with all the multisigs

remove this sentence

yvesbou · 2025-09-30T11:35:16Z

src/content/protocols/Cian.md

+
+| Name          | Account | Type     | ≥ 7 signers | ≥ 51% threshold | ≥ 50% non-insider | Signers public |
+| ------------- | ------- | -------- | ----------- | --------------- | ----------------- | -------------- |
+| Owner YlstETH (undeclared) | [0x261090afE1E7305474F4e3eEFCAca9964eBffFf5](https://etherscan.io/address/0x261090afE1E7305474F4e3eEFCAca9964eBffFf5)  | Multisig | ❌         | ❌              | ❌                | ✅             |


add to this table

Operator

Vault Owner

FeeReceiver

each EOA deserves 4 ❌

yvesbou · 2025-09-30T11:35:44Z

src/content/protocols/Cian.md

+
+| Name          | Account | Type     | ≥ 7 signers | ≥ 51% threshold | ≥ 50% non-insider | Signers public |
+| ------------- | ------- | -------- | ----------- | --------------- | ----------------- | -------------- |
+| Owner YlstETH (undeclared) | [0x261090afE1E7305474F4e3eEFCAca9964eBffFf5](https://etherscan.io/address/0x261090afE1E7305474F4e3eEFCAca9964eBffFf5)  | Multisig | ❌         | ❌              | ❌                | ✅             |


Suggested change

| Owner YlstETH (undeclared) | [0x261090afE1E7305474F4e3eEFCAca9964eBffFf5](https://etherscan.io/address/0x261090afE1E7305474F4e3eEFCAca9964eBffFf5) | Multisig | ❌ | ❌ | ❌ | ✅ |

| Owner YlstETH (undeclared) | [0x261090afE1E7305474F4e3eEFCAca9964eBffFf5](https://etherscan.io/address/0x261090afE1E7305474F4e3eEFCAca9964eBffFf5) | Multisig | ❌ | ❌ | ❌ | ❌ |

signers public means according to our framework that the signer's addresses are linked to a well known pseudonym or a real name

yvesbou · 2025-09-30T11:44:58Z

src/content/protocols/Cian.md

+| Name                   | Account                                                                                                               | Type     |
+| ---------------------- | --------------------------------------------------------------------------------------------------------------------- | -------- |
+| Owner (YlstETH)        | [0x261090afE1E7305474F4e3eEFCAca9964eBffFf5](https://etherscan.io/address/0x261090afE1E7305474F4e3eEFCAca9964eBffFf5) | Multisig |
+| Vault Owner            | [0x8FA9aa69a6e94c1cd49FbF214C833B2911D02553](https://etherscan.io/address/0x8FA9aa69a6e94c1cd49FbF214C833B2911D02553) | EOA      |


yvesbou · 2025-09-30T11:49:40Z

src/content/protocols/Cian.md

+| StrategyCompound (Implementation)         | deleverage                     | Repays debt to decrease the strategy's exposure and risk either to secure profits or reduce risk in volatile conditions.   | Manager (YlrsETH)              |
+| StrategyCompound (Implementation)         | claimAndSwap                   | It claims rewards tokens and immediately swaps them for the vault's base asset. This automates the process of compounding yield.   | Manager (YlrsETH)              |
+| StrategyAAVEV3RsETH (Proxy)               | upgradeToAndCall               | Updates the implementation of the `StrategyAAVEV3RsETH` contract. Can only be triggered by the Owner itself. A malicious `Owner` can replace `StrategyAAVEV3RsETH (Implementation)` and drain user funds.     | Owner (YlrsETH)                |
+| VaultYieldRSETH (Proxy)                   | upgradeToAndCall               | Updates the implementation of the `VaultYieldRSETH` contract. Can only be triggered by the Owner itself. A malicious `Vault Owner` can replace `VaultYieldRSETH (Implementation)` and drain user funds.     | Vault Owner                    |


Suggested change

| VaultYieldRSETH (Proxy) | upgradeToAndCall | Updates the implementation of the `VaultYieldRSETH` contract. Can only be triggered by the Owner itself. A malicious `Vault Owner` can replace `VaultYieldRSETH (Implementation)` and drain user funds. | Vault Owner |

| VaultYieldRSETH (Proxy) | upgradeToAndCall | Updates the implementation of the `VaultYieldRSETH` contract. Can only be triggered by the Owner itself. A malicious `Vault Owner` can replace `VaultYieldRSETH (Implementation)` and drain user funds. | Owner (YlrsETH) |

yvesbou · 2025-09-30T11:57:06Z

src/content/protocols/Cian.md

+Note: The permissions for all Manager contracts (YlFBTC, YlBTCLst, YlrsETH, YlstETH) are similar; therefore, only Manager (YlstETH) is shown on the permissions page. RedeemOperator contracts of (YlrsETH, YlstETH) have the same functions; only RedeemOperator (YlstETH) is shown on the permissions page. 
+The permissions for StrategyAAVEV3RsETH (Implementation) (YlstETH) and StrategyAAVEV3RsETH (Implementation) (YlrsETH) have similar functions; as a result, only one is shown on the permissions page. Likewise, StrategySolv (Implementation) (YlBTCLST) and StrategyPump (Implementation) have similar functions, so only StrategySolv is shown above.


bring this to the Reviewer's Notes section

yvesbou · 2025-09-30T12:07:22Z

src/content/protocols/Cian.md

+| VaultYieldETH (Implementation)            | updateRebalancer               | Updates the address authorized to perform rebalancing operations. A malicious `Owner` could set the rebalancer to an attacker's address, allowing them to drain funds through malicious strategies.    | Owner (YlstETH)                    |
+| VaultYieldETH (Implementation)            | updateFeeReceiver              | This function updates the address that receives collected fees. A malicious `Owner` could set the fee receiver to their own address redirecting all vault fees.    | Owner (YlstETH)                    |
+| VaultYieldETH (Implementation)            | updateRedeemOperator           | This function updates the address authorized to process user withdrawal requests. A malicious redeem operator can stop user withrawal requests.   | Owner (YlstETH)                    |
+| VaultYieldETH (Implementation)            | updateExchangePrice            | Updates the internal exchange rate between assets and shares, reflecting vault performance. A malicious `Owner` could manipulate the exchange price, causing accounting issues.    | Owner (YlstETH)              |


Suggested change

| VaultYieldETH (Implementation) | updateExchangePrice | Updates the internal exchange rate between assets and shares, reflecting vault performance. A malicious `Owner` could manipulate the exchange price, causing accounting issues. | Owner (YlstETH) |

| VaultYieldETH (Implementation) | updateExchangePrice | Updates the internal exchange rate between assets and shares, reflecting vault performance. A malicious `Owner` could manipulate the exchange price, causing accounting issues. | Manager (YlstETH) |

yvesbou · 2025-09-30T12:16:04Z

src/content/protocols/Cian.md

+
+## Autonomy
+
+As a yield aggregator protocol, Cian sources its yield from multiple protocols. These are divided into three main categories depending on the yield source: staking yield, restaking yield, and lending yield sources. Examples include Lido Protocol for staking yield, Symbiotic, Mellow Protocol and Renzo Protocol for restaking yield, and Aave and Sparklend for lending yield sources. Dependence on multiple protocols that are at stage 0 on their decentralzation score increases dependecy failure and complexity. A failure on any of these protocols could result in loss or thefts of user fund or degraded protocol experience for users.


Suggested change

As a yield aggregator protocol, Cian sources its yield from multiple protocols. These are divided into three main categories depending on the yield source: staking yield, restaking yield, and lending yield sources. Examples include Lido Protocol for staking yield, Symbiotic, Mellow Protocol and Renzo Protocol for restaking yield, and Aave and Sparklend for lending yield sources. Dependence on multiple protocols that are at stage 0 on their decentralzation score increases dependecy failure and complexity. A failure on any of these protocols could result in loss or thefts of user fund or degraded protocol experience for users.

As a yield aggregator protocol, Cian sources its yield from multiple protocols. These are divided into three main categories depending on the yield source: staking yield, restaking yield, and lending yield sources. Examples include Lido Protocol for staking yield, Symbiotic, Mellow Protocol and Renzo Protocol for restaking yield, and Aave and Sparklend for lending yield sources. Aave and Lido were classified as _Stage 0_, the other mentioned protocols are not yet classified. Since user funds are invested into these protocols centralization risks are inherited through the dependencies. Exploitation through centralization vectors in the 3rd party protocols would lead to _loss of funds_ or _loss of unclaimed yield_ for users.

yvesbou · 2025-09-30T12:27:52Z

src/content/protocols/Cian.md

+
+## Exit Window
+
+The multisig can arbitrarily upgrade the Cian Yield layer contracts without a timelock mechanism, and likewise, the strategy and manager contracts can also be arbitrarily updated. Additionally, the EOA can make arbitrary changes to positions. This makes the Cian Yield layer achieve a high exit score.


Suggested change

The multisig can arbitrarily upgrade the Cian Yield layer contracts without a timelock mechanism, and likewise, the strategy and manager contracts can also be arbitrarily updated. Additionally, the EOA can make arbitrary changes to positions. This makes the Cian Yield layer achieve a high exit score.

There are no existing timelocks that create an exit window for contract upgrades through listed multisigs and EOAs in the permission owners table. All permissioned function calls are enforced immediately. This makes the Cian Yield layer achieve a _High_ Exit Window score.

BowtiedRahman added 2 commits June 1, 2025 20:39

Add files via upload

38c556f

Add files via upload

2f9e20f

vercel bot deployed to Preview June 1, 2025 19:44 View deployment

yvesbou changed the title ~~First draft submission~~ Cian Protocol | Ethereum | Submission Review Jun 2, 2025

yvesbou added Bounty In Progress labels Jun 2, 2025

yvesbou mentioned this pull request Jun 2, 2025

Cian Protocol | Ethereum | 01.06.2025 #140

Closed

yvesbou added the $2000 label Jun 2, 2025

nbundi assigned yvesbou Jun 4, 2025

yvesbou changed the base branch from cian to main June 13, 2025 13:34

scanned permissions

efc2d53

vercel bot deployed to Preview June 15, 2025 15:18 View deployment

yvesbou requested changes Jun 15, 2025

View reviewed changes

src/content/protocols/Cian.md Outdated Show resolved Hide resolved

src/content/protocols/Cian.md Outdated Show resolved Hide resolved

src/content/protocols/Cian.md Outdated Show resolved Hide resolved

src/content/protocols/Cian.md Outdated Show resolved Hide resolved

Yield Layer rsETH added

2698c8e

vercel bot deployed to Preview June 16, 2025 07:59 View deployment

YlBTCLst added

b765ef7

vercel bot deployed to Preview June 16, 2025 09:22 View deployment

added contract list

7524663

vercel bot deployed to Preview June 16, 2025 09:27 View deployment

added fBTC yield layer

c15d1a5

yvesbou requested changes Aug 29, 2025

View reviewed changes

yvesbou assigned BowtiedRahman and unassigned yvesbou Aug 29, 2025

Update src/content/protocols/Cian.md

0d7ede5

Co-authored-by: Yves Boutellier <63062257+yvesbou@users.noreply.github.com>

vercel bot deployed to Preview August 31, 2025 20:14 View deployment

Update src/content/protocols/Cian.md

a1ff98a

Co-authored-by: Yves Boutellier <63062257+yvesbou@users.noreply.github.com>

vercel bot deployed to Preview September 4, 2025 14:29 View deployment

Update src/content/protocols/Cian.md

69e3fa2

Co-authored-by: Yves Boutellier <63062257+yvesbou@users.noreply.github.com>

vercel bot deployed to Preview September 4, 2025 14:35 View deployment

BowtiedRahman and others added 3 commits September 4, 2025 15:38

Update src/content/protocols/Cian.md

63e7ee2

Co-authored-by: Yves Boutellier <63062257+yvesbou@users.noreply.github.com>

Update src/content/protocols/Cian.md

32ecfc2

Co-authored-by: Yves Boutellier <63062257+yvesbou@users.noreply.github.com>

Update src/content/protocols/Cian.md

9e4e0ff

Co-authored-by: Yves Boutellier <63062257+yvesbou@users.noreply.github.com>

vercel bot deployed to Preview September 4, 2025 14:40 View deployment

BowtiedRahman added 3 commits September 13, 2025 13:35

Fixed all suggestions and implemented all fixes.

719488f

modified: src/content/protocols/Cian.md

699a7b7

Implemented all fixes.

3bbd2f3

vercel bot deployed to Preview September 13, 2025 14:33 View deployment

yvesbou requested changes Oct 2, 2025

View reviewed changes

	\| Undeclared Multisig \| [0x261090afE1E7305474F4e3eEFCAca9964eBffFf5](https://etherscan.io/address/0x261090afE1E7305474F4e3eEFCAca9964eBffFf5) \| Multisig \| ✅ \| ❌ \| ❌ \| ✅ \|
	\| Owner YlstETH (undeclared) \| [0x261090afE1E7305474F4e3eEFCAca9964eBffFf5](https://etherscan.io/address/0x261090afE1E7305474F4e3eEFCAca9964eBffFf5) \| Multisig \| ❌ \| ✅ \| ❌ \| ❌ \|

Name	Account	Type
Vault Owner	0x8FA9aa69a6e94c1cd49FbF214C833B2911D02553	EOA
Operator	0x994Cc8Ef6aC289d0016dC28E691CF75eaE4e776b	Contract
Rebalancer 2 (YlstETH)	0x7c0393F1CF1faf3106478960bEf21635Ff6182C4	Multisig
Rebalancer 2 (YlrsETH)	0x20E5737D4B888154c8220304310aBb8b63881D2a	Multisig
FeeReceiver	0xc554747ffde2e378a562a09f2f72f4121C1d493D	EOA
Owner (YlrsETH)	0x0b5d3121E144cf1410850c9608651a039BFd543e	Multisig
Owner (YlBTCLST)	0x28784DbF1DA93da28873c9f4A8B471D64A11FCfd	Multisig

		## Upgradeability


		The Cian Yield Layer is upgradable allowing for the updates of all vaults (`YlFBTC`, `YlBTCLst`, `YlrsETH`, `YlstETH`) and their associated strategy contracts which are adapters to the yield sources. This can result in the _loss of funds_ or _loss of unclaimed yield_ as well as lead to other changes in the expected performance of the protocol.

	\| Vault Owner \| [0x8FA9aa69a6e94c1cd49FbF214C833B2911D02553](https://etherscan.io/address/0x8FA9aa69a6e94c1cd49FbF214C833B2911D02553) \| EOA \|
	\| Owner (YlFBTC) \| [0x8FA9aa69a6e94c1cd49FbF214C833B2911D02553](https://etherscan.io/address/0x8FA9aa69a6e94c1cd49FbF214C833B2911D02553) \| EOA \|

	\| VaultYieldRSETH (Proxy) \| upgradeToAndCall \| Updates the implementation of the `VaultYieldRSETH` contract. Can only be triggered by the Owner itself. A malicious `Vault Owner` can replace `VaultYieldRSETH (Implementation)` and drain user funds. \| Vault Owner \|
	\| VaultYieldRSETH (Proxy) \| upgradeToAndCall \| Updates the implementation of the `VaultYieldRSETH` contract. Can only be triggered by the Owner itself. A malicious `Vault Owner` can replace `VaultYieldRSETH (Implementation)` and drain user funds. \| Owner (YlrsETH) \|

		Note: The permissions for all Manager contracts (YlFBTC, YlBTCLst, YlrsETH, YlstETH) are similar; therefore, only Manager (YlstETH) is shown on the permissions page. RedeemOperator contracts of (YlrsETH, YlstETH) have the same functions; only RedeemOperator (YlstETH) is shown on the permissions page.
		The permissions for StrategyAAVEV3RsETH (Implementation) (YlstETH) and StrategyAAVEV3RsETH (Implementation) (YlrsETH) have similar functions; as a result, only one is shown on the permissions page. Likewise, StrategySolv (Implementation) (YlBTCLST) and StrategyPump (Implementation) have similar functions, so only StrategySolv is shown above. No newline at end of file

	\| VaultYieldETH (Implementation) \| updateExchangePrice \| Updates the internal exchange rate between assets and shares, reflecting vault performance. A malicious `Owner` could manipulate the exchange price, causing accounting issues. \| Owner (YlstETH) \|
	\| VaultYieldETH (Implementation) \| updateExchangePrice \| Updates the internal exchange rate between assets and shares, reflecting vault performance. A malicious `Owner` could manipulate the exchange price, causing accounting issues. \| Manager (YlstETH) \|


		## Autonomy

		As a yield aggregator protocol, Cian sources its yield from multiple protocols. These are divided into three main categories depending on the yield source: staking yield, restaking yield, and lending yield sources. Examples include Lido Protocol for staking yield, Symbiotic, Mellow Protocol and Renzo Protocol for restaking yield, and Aave and Sparklend for lending yield sources. Dependence on multiple protocols that are at stage 0 on their decentralzation score increases dependecy failure and complexity. A failure on any of these protocols could result in loss or thefts of user fund or degraded protocol experience for users.


		## Exit Window

		The multisig can arbitrarily upgrade the Cian Yield layer contracts without a timelock mechanism, and likewise, the strategy and manager contracts can also be arbitrarily updated. Additionally, the EOA can make arbitrary changes to positions. This makes the Cian Yield layer achieve a high exit score.

	The multisig can arbitrarily upgrade the Cian Yield layer contracts without a timelock mechanism, and likewise, the strategy and manager contracts can also be arbitrarily updated. Additionally, the EOA can make arbitrary changes to positions. This makes the Cian Yield layer achieve a high exit score.
	There are no existing timelocks that create an exit window for contract upgrades through listed multisigs and EOAs in the permission owners table. All permissioned function calls are enforced immediately. This makes the Cian Yield layer achieve a _High_ Exit Window score.

Conversation

BowtiedRahman commented Jun 1, 2025

Uh oh!

vercel bot commented Jun 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BowtiedRahman commented Jun 5, 2025

Uh oh!

yvesbou commented Jun 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BowtiedRahman commented Jun 11, 2025

Uh oh!

yvesbou commented Jun 11, 2025

Uh oh!

BowtiedRahman commented Jun 14, 2025

Uh oh!

yvesbou commented Jun 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yvesbou commented Jun 15, 2025

Uh oh!

BowtiedRahman commented Jun 15, 2025

Uh oh!

yvesbou left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

yvesbou commented Jun 15, 2025

Uh oh!

emduc commented Jul 14, 2025

Uh oh!

BowtiedRahman commented Aug 3, 2025

Uh oh!

BowtiedRahman commented Aug 4, 2025

Uh oh!

BowtiedRahman commented Aug 5, 2025

Uh oh!

BowtiedRahman commented Aug 11, 2025

Uh oh!

emduc commented Aug 11, 2025

Uh oh!

BowtiedRahman commented Aug 12, 2025

Uh oh!

yvesbou left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BowtiedRahman commented Aug 31, 2025

Uh oh!

BowtiedRahman commented Sep 13, 2025

Uh oh!

BowtiedRahman commented Sep 16, 2025

Uh oh!

yvesbou commented Sep 16, 2025

Uh oh!

BowtiedRahman commented Sep 24, 2025

Uh oh!

Choose a reason for hiding this comment

vercel bot commented Jun 1, 2025 •

edited

Loading

yvesbou commented Jun 6, 2025 •

edited

Loading

yvesbou commented Jun 15, 2025 •

edited

Loading