Audit Report (Colony)

Paladin19 Feb 202415 addresses on Avalanche

Paladin reviewed COLONY (Audit Report (Colony)) on 19 Feb 2024: 89 findings, 0 critical; 59 marked fixed, 29 acknowledged, 1 open.

No open critical findings

Open the report Open COLONY’s security record

Report hosted on paladinsec.co.

Trustblock does not review code.

Findings89

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	12	7
Medium	0	5	7
Low	1	12	45

HighAdmin/Owner can steal the stablecoinAcknowledged

The report gives no description here.

HighCodebase does not work with tokens that have a fee on transferAcknowledged

The report gives no description here.

HighCompromised contract owner/admin can DoS functionalitiesAcknowledged

The report gives no description here.

HighContract owner can DoS base functionalitiesAcknowledged

The report gives no description here.

HighContract owner can steal all collected stablecoinsAcknowledged

The report gives no description here.

HighGovernance: Privileged addresses can permanently lock users’ tokensAcknowledged

The report gives no description here.

HighGovernance: The contract owner can DoS deal finalizationAcknowledged

The report gives no description here.

HighLack of validationAcknowledged

The report gives no description here.

HighOwner of EarlyStageManager can harm the project via multiple vectorsAcknowledged

The report gives no description here.

HighPrivileged addresses can permanently lock users’ tokensAcknowledged

The report gives no description here.

Show 10 more

HighSub-optimal implementation of swap logicAcknowledged

The report gives no description here.

HighThe contract owner can DoS swapsAcknowledged

The report gives no description here.

MediumChange of rewarder will lead to implicationsAcknowledged

The report gives no description here.

MediumConsecutive project token claims will reset unlock progressAcknowledged

The report gives no description here.

MediumMalicious colonyAddress can block initial liquidity creationAcknowledged

The report gives no description here.

MediumUsers can easily adjust their allocationsAcknowledged

The report gives no description here.

MediumVesting data can only be updated after investments already happenedAcknowledged

The report gives no description here.

LowallocationToken can be made immutableAcknowledged

The report gives no description here.

LowAn outdated version of OwnableUpgradeable is usedAcknowledged

The report gives no description here.

LowEven with KYC-ed accounts, the contracts can still be Sybil attackedAcknowledged

The report gives no description here.

Show 9 more

LowGeneral architectural riskAcknowledged

The report gives no description here.

LowMalicious/invalid AntTierProgram contract can DoS swapsAcknowledged

The report gives no description here.

LowMissing revert for failed deploymentsAcknowledged

The report gives no description here.

LowRefunded phase cannot be initiated after finalInvestment is setAcknowledged

The report gives no description here.

LowRemoval of KYC-ed status may result in forced penaltyAcknowledged

The report gives no description here.

LowSet of invalid AntTierProgram can DoS swapsAcknowledged

The report gives no description here.

LowtokenPrice lacks an upper limitAcknowledged

The report gives no description here.

LowUpdate to the Portfolio phase can happen without LP/farm creationAcknowledged

The report gives no description here.

LowVariable swap fee approach does not work with account abstractionAcknowledged

The report gives no description here.

Contracts in scope15

Address	Chain	Source code
0xc5f368e6d0192764547c4209a7e622fc05c82fcb	Chain: Avalanche	Source code: Verified source
0x3db497a9783ebbeda6950d4f1911b3a27d79c071	Chain: Avalanche	Source code: Verified source
0xc73aedd4853c6c7dda8a94ca78c5a9d4daef8ee6	Chain: Avalanche	Source code: Verified source
0x4bf0c9f164e8b9771220e777199be99e1af23d48	Chain: Avalanche	Source code: Verified source
0xd40e60ea9487fa1b625321467edcc1d9b422b577	Chain: Avalanche	Source code: Verified source
0x9e1ac58559307a7ce70104810b7d6e43e74bfa1e	Chain: Avalanche	Source code: Verified source
0x1988aaddae2c42a05f31a516b4462253b063cd2b	Chain: Avalanche	Source code: Verified source
0xa2e7ab89a2c59818e1ecd925e718a9d63889a131	Chain: Avalanche	Source code: Verified source
0x2ac45f92eabaa8dcb2ea1807a659a1393c3947d0	Chain: Avalanche	Source code: Verified source
0x1a5bdc587e84e215e61b87e433c180611e71f4e6	Chain: Avalanche	Source code: Verified source

Show the other 5 addresses

Address	Chain	Source code
0x814ebf333bdaf1d2d364c22a1e2400a812f1f850	Chain: Avalanche	Source code: Verified source
0xcc42c3fdd8c0400236c7cfa29d3687adb6b1d780	Chain: Avalanche	Source code: Verified source
0x0a00a74f28d1bc24ddf73794fcd594cbbf291641	Chain: Avalanche	Source code: Verified source
0x62b38293896e040e36fe5345f9d30dbfd75c04b9	Chain: Avalanche	Source code: Verified source
0xb746d18f93b9264ba08d6a38e934329c984e75ec	Chain: Avalanche	Source code: Verified source

Part of COLONY’s security record

COLONY

Audits2 audits by 1 firmLast audit Feb 2024, by Paladin.

Critical findingsNo open critical findingsAcross 2 reports.

Open COLONY’s security record

Security firm

Paladin

176 projects reviewed · 241 reports · latest Apr 2025

See Paladin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.