Reentrancy guard on external-calling functions

Beefy Finance's assessment for RD-F-014 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

BeefyVaultV7.deposit() has nonReentrant. BeefyVaultV7.withdraw() does NOT have nonReentrant despite calling want().safeTransfer() to caller. BeefyVaultV7Native.depositBNB() has nonReentrant; both withdrawal functions lack it. BaseAllToNativeStrat neither deposit() nor withdraw() have reentrancy guard. Pattern risk exists in withdrawal paths; CEI mitigates but is not audited.

Sources #

GitHub
BaseAllToNativeStrat.solBaseAllToNativeStrat.sol — neither deposit() nor withdraw() have reentrancy guardsretrieved 2026-05-16
GitHub
BeefyVaultV7.sol withdraw functionBeefyVaultV7.sol — withdraw() lacks nonReentrant; deposit() has nonReentrantretrieved 2026-05-16

Methodology #

Determine whether all state-mutating functions that perform external calls carry `nonReentrant` or an equivalent reentrancy guard.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol beefy factor RD-F-014 score yellow collected_at 2026-05-16 13:10:30