Reentrancy guard on external-calling functions

Fluid's assessment for RD-F-014 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

VaultT1 operate() and liquidate() use toggle-based reentrancy guard (vaultVariables_ & 1). MixBytes audit identified cross-contract reentrancy as medium issue and confirmed mitigation added. Yellow because the reentrancy guard is non-standard toggle (not OZ nonReentrant) and only applies to specific functions.

Sources #

GitHub
Fluid VaultT1 Core ModuleVaultT1 coreModule/main.sol — toggle reentrancy guardretrieved 2026-04-29
Audit
MixBytes Fluid VaultT1 Audit READMEMixBytes VaultT1 README — reentrancy medium finding, addressedretrieved 2026-04-29

Methodology #

Determine whether all state-mutating functions that perform external calls carry `nonReentrant` or an equivalent reentrancy guard.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol fluid factor RD-F-014 score yellow collected_at 2026-04-29 10:35:01