Arcadia audit
Audit competition · firm’s term: security review
Sherlock reviewed Arcadia (Arcadia audit) on 16 Feb 2024: 9 findings, 0 critical; 8 marked fixed, 1 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 1 | 5 |
| Low | 0 | 0 | 0 |
HighAccountV1#flashActionByCreditor can be used to drain assets from account without withdrawingFixed
The report gives no description here.
HighCaching Uniswap position liquidity allows borrowing using undercollateralized Uni positionsFixed
The report gives no description here.
HighReentrancy in flashAction() allows draining liquidity poolsFixed
The report gives no description here.
MediumCREATE2 address collision against an Account will allow complete draining of lending poolsFixed
The report gives no description here.
MediumL2 sequencer down will push an auction's price down, causing unfair liquidation prices, and potentially guaranteeing bad debtFixed
The report gives no description here.
MediumLendingPool#flashAction is broken when trying to refinance position across LendingPools due to improper access controlFixed
The report gives no description here.
MediumStargate STG rewards are accounted incorrectly by StakedStargateAM.solFixed
The report gives no description here.
MediumUtilisation Can Be Manipulated Far Above 100%Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Arcadia’s security record
ArcadiaSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us