Audit Report (Colony)

Paladin19 Feb 202415 addresses on Avalanche

Paladin reviewed COLONY (Audit Report (Colony)) on 19 Feb 2024: 89 findings, 0 critical; 59 marked fixed, 29 acknowledged, 1 open.

No open critical findings

Open the report Open COLONY’s security record

Report hosted on paladinsec.co.

Trustblock does not review code.

Findings89

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	12	7
Medium	0	5	7
Low	1	12	45

HighA malicious attacker can steal projectTokenFixed

The report gives no description here.

HighcheckClaimableCeTokens relies on variable that can be changedFixed

The report gives no description here.

HighOwner can set a malicious/flawed ceTokenDistributorFixed

The report gives no description here.

HighOwner has full control over share distribution and recipient addressesFixed

The report gives no description here.

HighRegistering a malicious ceToken would overwrite the reward tokenFixed

The report gives no description here.

HighThe contract owner can DoS deal finalizationFixed

The report gives no description here.

HighVesting parameters cannot be updatedFixed

The report gives no description here.

MediumGeneral lack of CEIFixed

The report gives no description here.

MediumLack of upper fee limitFixed

The report gives no description here.

Mediumschedule.releaseDate can be same timestampFixed

The report gives no description here.

Show 10 more

MediumsetStableCoinDistributionStrategy is not exposedFixed

The report gives no description here.

MediumUnclaimed tokens are lostFixed

The report gives no description here.

MediumUsage of msg.sender for fee valueFixed

The report gives no description here.

MediumUsers can circumvent the special fee logicFixed

The report gives no description here.

LowantTierProgram may differ from the actual programFixed

The report gives no description here.

LowantToken can be made immutableFixed

The report gives no description here.

LowAnyone can call finalizeDealFixed

The report gives no description here.

LowCEI pattern is not adhered toFixed

The report gives no description here.

LowChecks-effects-interactions pattern is not adhered toFixed

The report gives no description here.

LowContract balance is used as lpSupplyFixed

The report gives no description here.

Show 10 more

LowContract is not abstractFixed

The report gives no description here.

LowDecimal return values might be incorrectFixed

The report gives no description here.

LowDOMAIN_SEPARATOR can be made immutableFixed

The report gives no description here.

Lowfactory can be made immutableFixed

The report gives no description here.

LowfindTierIndex might run out of gasFixed

The report gives no description here.

LowGas optimizationFixed

The report gives no description here.

LowGas optimizationFixed

The report gives no description here.

LowGeneral lack of address(0) validationFixed

The report gives no description here.

LowLack of checks-effects-interactionsFixed

The report gives no description here.

LowLack of checks-effects-interactionsFixed

The report gives no description here.

Show 10 more

LowLack of events for updatePrivilegedFixed

The report gives no description here.

LowlinearVestingFactory and discreteVestingFactory are set without emitting the events in the constructorFixed

The report gives no description here.

LowMissing gapFixed

The report gives no description here.

LowMissing visibility for privileged addressesFixed

The report gives no description here.

LowMissing visibility for privileged addressesFixed

The report gives no description here.

LowMissing visibility of all vestingCreatorsFixed

The report gives no description here.

LowMissing visibility of all vestingCreatorsFixed

The report gives no description here.

Lownest can be made immutableFixed

The report gives no description here.

LowPhases can be hardcoded in the bytecode of the contract to save some gasFixed

The report gives no description here.

LowRead-only reentrancy within onRewardFixed

The report gives no description here.

Show 10 more

LowSchedule length is uncheckedFixed

The report gives no description here.

LowSchedules can contain zero amountsFixed

The report gives no description here.

LowSeveral variables can be made immutableFixed

The report gives no description here.

LowshareMantissa rounds down in the case of a very low token allocationFixed

The report gives no description here.

LowstakingRewardsDuration and stakingV2 can be made immutableFixed

The report gives no description here.

LowThe whitelisted pools are not directly usedFixed

The report gives no description here.

LowTypographical issueFixed

The report gives no description here.

LowTypographical issuesFixed

The report gives no description here.

LowTypographical issuesFixed

The report gives no description here.

LowTypographical issuesFixed

The report gives no description here.

Show 9 more

LowUI function getProjectNests can run out of gasFixed

The report gives no description here.

LowUnecessary roundingsFixed

The report gives no description here.

LowUnnecessary roundingFixed

The report gives no description here.

LowUnused code sectionsFixed

The report gives no description here.

LowUnused importsFixed

The report gives no description here.

LowUsers can deposit arbitrary lp tokensFixed

The report gives no description here.

LowVariable(s) can be immutableFixed

The report gives no description here.

LowvestingFactory can be made immutableFixed

The report gives no description here.

LowvestingFactory can be made immutableFixed

The report gives no description here.

Contracts in scope15

Address	Chain	Source code
0xc5f368e6d0192764547c4209a7e622fc05c82fcb	Chain: Avalanche	Source code: Verified source
0x3db497a9783ebbeda6950d4f1911b3a27d79c071	Chain: Avalanche	Source code: Verified source
0xc73aedd4853c6c7dda8a94ca78c5a9d4daef8ee6	Chain: Avalanche	Source code: Verified source
0x4bf0c9f164e8b9771220e777199be99e1af23d48	Chain: Avalanche	Source code: Verified source
0xd40e60ea9487fa1b625321467edcc1d9b422b577	Chain: Avalanche	Source code: Verified source
0x9e1ac58559307a7ce70104810b7d6e43e74bfa1e	Chain: Avalanche	Source code: Verified source
0x1988aaddae2c42a05f31a516b4462253b063cd2b	Chain: Avalanche	Source code: Verified source
0xa2e7ab89a2c59818e1ecd925e718a9d63889a131	Chain: Avalanche	Source code: Verified source
0x2ac45f92eabaa8dcb2ea1807a659a1393c3947d0	Chain: Avalanche	Source code: Verified source
0x1a5bdc587e84e215e61b87e433c180611e71f4e6	Chain: Avalanche	Source code: Verified source

Show the other 5 addresses

Address	Chain	Source code
0x814ebf333bdaf1d2d364c22a1e2400a812f1f850	Chain: Avalanche	Source code: Verified source
0xcc42c3fdd8c0400236c7cfa29d3687adb6b1d780	Chain: Avalanche	Source code: Verified source
0x0a00a74f28d1bc24ddf73794fcd594cbbf291641	Chain: Avalanche	Source code: Verified source
0x62b38293896e040e36fe5345f9d30dbfd75c04b9	Chain: Avalanche	Source code: Verified source
0xb746d18f93b9264ba08d6a38e934329c984e75ec	Chain: Avalanche	Source code: Verified source

Part of COLONY’s security record

COLONY

Audits2 audits by 1 firmLast audit Feb 2024, by Paladin.

Critical findingsNo open critical findingsAcross 2 reports.

Open COLONY’s security record

Security firm

Paladin

176 projects reviewed · 241 reports · latest Apr 2025

See Paladin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.