Skip to content
Quantix Security Labs

Veyra Finance

Pooled lending with permit-based deposits and flash loans.

A pooled money market on Base. Deposits accept EIP-2612 permits, borrowing is priced from oracle feeds with an L2 sequencer check, and the pool offers flash loans that settle within a single transaction.

Ecosystem
BASEBase
Category
Lending
Languages
Solidity
Launched
Dec 2025
77.9BBBModerate risk

Grade BBB · Moderate risk

Adequate posture with notable weaknesses in one or more areas.

+3.0 since Dec 2025 · +0.4 since Jul 2026

Quantix Protocol Research · as of 24 Oct 2026 · About this data

Risk Index

How the score is built

Six weighted components, each scored 0–100 where higher means less risk. Points are the component value multiplied by its weight; the gap is what the component costs against a perfect score.
ComponentWeightValuePointsGap
Code Security30%7622.8−7.2
Operational Security20%7815.6−4.4
Governance Risk15%8012.0−3.0
Economic Security15%7411.1−3.9
Infrastructure Resilience10%808.0−2.0
Transparency10%848.4−1.6
Quantix Risk Index100%77.9−22.1
CodeOperationalGovernanceEconomicInfrastructureTransparencyVeyra Finance, Code: 76Veyra Finance, Operational: 78Veyra Finance, Governance: 80Veyra Finance, Economic: 74Veyra Finance, Infrastructure: 80Veyra Finance, Transparency: 84
Risk Index components: Veyra Finance Code 76, Operational 78, Governance 80, Economic 74, Infrastructure 80, Transparency 84
ComponentVeyra Finance
Code76
Operational78
Governance80
Economic74
Infrastructure80
Transparency84

Grade scale

  1. AAA90–100
  2. AA85–89.9
  3. A80–84.9
  4. BBB75–79.9
  5. BB70–74.9
  6. B65–69.9
  7. CCC60–64.9
  8. CC55–59.9
  9. C50–54.9
  10. D0–49.9

Score history

11 monthly snapshots

Each point is the Risk Index computed from that month’s component values. Markers below the chart show the events that moved a component; the history starts at launch in Dec 2025.
Veyra Finance Quantix Risk Index by month
PeriodQuantix Risk Index
Dec ’2574.9
Jan ’2674.9
Feb ’2677.1
Mar ’2677.1
Apr ’2677.5
May ’2677.5
Jun ’2677.5
Jul ’2677.5
Aug ’2677.5
Sep ’2677.9
Oct ’2677.9

  1. 22 Sept 2026

    Economic

    Flash-loan guard

    Flash loans pause automatically when feeds disagree.

    • Economic Security+3

  2. 7 Apr 2026

    Infrastructure

    Sequencer-aware oracle

    Oracle aggregator adds the Base sequencer uptime check.

    • Infrastructure Resilience+4

  3. 27 Feb 2026

    Research assessment

    Research assessment completed: Smart Contract Audit

    8 findings (2 high, 3 medium, 2 low, 1 informational). All critical and high findings addressed.

    Read the research assessment
    • Code Security+6
    • Transparency+4

Risk factors

What keeps the score from being higher, most severe first.

  • MediumEconomic SecurityProfile analysis

    Flash loans amplify oracle weaknesses

    Same-transaction liquidity lets an attacker test any pricing edge at no capital cost, so oracle bounds must hold under adversarial conditions.

  • MediumEconomic SecurityProfile analysis

    Two-feed aggregation

    The oracle averages two sources with a 2% deviation guard; if one source fails, liquidations rely on a single feed.

  • LowCode SecurityFrom the research assessment

    1 lower-severity finding not fully resolved

    Medium, low or informational findings remain open or partially resolved in the research assessment.

Recommendations

Each recommendation raises one component to a target value. The score effect is recomputed with the Risk Index model, holding every other component fixed.

  • Code Security: 76 → 84

    Invariant fuzzing in CI

    Run pool-accounting invariants on every change, including flash-loan paths.

    +2.4

    → 80.3

  • Economic Security: 74 → 82

    Bound liquidation prices with a TWAP

    Reject liquidations when spot and TWAP diverge beyond the deviation guard.

    +1.2

    → 79.1

Analysis

Contract, governance and operations

Contract analysis

Source
Verified
Upgradeability
Transparent proxy
Administrative control
Veyra timelock (48 h) with an emergency pause multisig
Enforced delay
48 hours
External dependencies
Two aggregated price feeds; Base sequencer uptime feed
  • PassSource verified. Pool, receipts, oracle and liquidator verified.
  • PassSequencer check. Borrowing pauses during sequencer downtime.
  • CautionFlash loans. Flash loans remain available while oracle sources disagree.
  • PassPermit deposits. Deposits tolerate front-run permits by falling back to allowance.

Governance exposure

Low

Parameter and upgrade changes pass a 48-hour timelock; an emergency multisig can only pause.

Operational resilience

Adequate

Oracle deviation alerts are in place; liquidation keepers are run by the team and the public.

Monitoring

Monitoring history

1 recorded security events for Veyra Finance, most recent first.
Open in Security Monitoring
  1. 24 Jun 2026HighPrice deviation of 2.3% after sequencer restartSecurity Alert · PriceOracleResolved

Research assessment

QX-TSA-2026-007Smart Contract AuditPublished

Lending pool, vTokens with permit, price oracle, liquidator and treasury. 1,927 nSLOC of Solidity on Base.

Review 9 Feb 2026 – 27 Feb 2026 · published 24 Mar 2026

Critical0
High2
Medium3
Low2
Informational1
  • 6 resolved
  • 1 partially resolved
  • 1 acknowledged
  • 0 open
Read the assessmentReport PDF

Continue with

Comparable protocols

Compare side by side

Research

Relevant research

Publications on the risks that matter most for a lending protocol.

Architecture

System components

LendingPool
Deposits, borrows, repayments and flash loans
vToken
Interest-bearing deposit receipts
PriceOracle
Aggregated price feeds with sequencer-uptime check
Liquidator
Liquidation auctions for unhealthy positions
Treasury
Reserve factor accrual and withdrawals

Turn risk factors into a remediation plan.

A research assessment traces each weakness to code, configuration or process, and verifies the fix before the score moves.

Discuss Your Security RequirementsBack to the Security Explorer