Liquity V2 - Voting Smart Contracts

ChainSecurityRepository at commit 168760d

Audit

ChainSecurity reviewed Liquity V2 (Liquity V2 - Voting Smart Contracts) on 22 Jan 2025: 37 findings, 1 critical; all marked fixed.

1 critical finding, fixed
Open the reportOpen Liquity V2’s security record

Report hosted on chainsecurity.com.

Trustblock does not review code.

Findings37

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical001
High006
Medium0011
Low0019
CriticalInitiative Votes Can Be ManipulatedFixed

The report gives no description here.

HighDeallocating From DISABLED Initiatives Makes GlobalState IncorrectFixed

The report gives no description here.

HighInitiative Hooks Are Susceptible to Low Gas AttacksFixed

The report gives no description here.

HighTypo in the Code Causes Incorrect CalculationFixed

The report gives no description here.

HighUser's Average Timestamp Can Change Between Allocation and Deallocation of LQTYFixed

The report gives no description here.

HighVote Tallying Is IncorrectFixed

The report gives no description here.

HighVotes in BribeInitiative Are Evaluated at Current TimestampFixed

The report gives no description here.

MediumBribe Accounting Is Based on LQTY Amounts Instead of VotesFixed

The report gives no description here.

MediumBribes Are Capped at Total BalanceFixed

The report gives no description here.

MediumConflicting Functionalities for ForwardBribeFixed

The report gives no description here.

Show 10 more
MediumEOAs Are Not Supported as InitiativesFixed

The report gives no description here.

MediumGovernance Does Not Enforce Warm-Up Period for InitiativesFixed

The report gives no description here.

MediumInitiative Deregisterability Is InconsistentFixed

The report gives no description here.

MediumInitiative Is Deregisterable Right After ClaimingFixed

The report gives no description here.

MediumInitiative's Timestamp Can Be ManipulatedFixed

The report gives no description here.

MediumPossible Frontrun in CurveV2GaugeRewardsFixed

The report gives no description here.

MediumStuck AllocationsFixed

The report gives no description here.

MediumUnsafe Casting on Math FunctionsFixed

The report gives no description here.

Low_calculateAverageTimestamp() Could Be off by One SecondFixed

The report gives no description here.

LowAllocation of Zero LQTY Triggers State Updates and Emit EventsFixed

The report gives no description here.

Show 10 more
LowCurveV2GaugeRewards Does Not Check remainderFixed

The report gives no description here.

LowIncomplete EventsFixed

The report gives no description here.

LowInconsistent Behavior for Retrieval of Tokens From Staking V1Fixed

The report gives no description here.

LowIncorrect SpecificationsFixed

The report gives no description here.

LowInitiative Snapshot Is Never DeletedFixed

The report gives no description here.

LowInitiatives Can Be Registered With No Staking in First WeeksFixed

The report gives no description here.

LowMeaningless Checks in BribeInitiative._claimBribe()Fixed

The report gives no description here.

LowMismatch of Code With the Error MessageFixed

The report gives no description here.

LowPossible Simplification of onAfterAllocateLQTYFixed

The report gives no description here.

LowPossible Underflow in withdrawLQTYFixed

The report gives no description here.

Show 7 more
LowRemaining ToDos in the CodebaseFixed

The report gives no description here.

LowReturn Value of Ether TransferFixed

The report gives no description here.

LowRounding Error on Offset CalculationFixed

The report gives no description here.

LowSpecial Check in onAfterAllocateLQTYFixed

The report gives no description here.

LowUnnecessary Approval Given to LQTYStakingFixed

The report gives no description here.

LowUnsafe Casting in lqtyToVotesFixed

The report gives no description here.

LowVotes for UNREGISTERABLE InitiativesFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (38)

  • https://github.com/liquity/v2-gov/src/UserProxyFactory.sol at commit 168760d750d7051c51f9804b136e1032f7e72f65
  • https://github.com/liquity/v2-gov/src/utils/Math.sol at commit d11e15a11ebdb26c7b297572d9674a7801f50922
  • https://github.com/liquity/v2-gov/src/UserProxy.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/utils/VotingPower.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/UserProxy.sol at commit 1add9a44d62faa8d7ab382d5d00ffcf8f522faee
  • https://github.com/liquity/v2-gov/src/utils/Math.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/utils/Ownable.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/utils/Types.sol at commit d11e15a11ebdb26c7b297572d9674a7801f50922
  • https://github.com/liquity/v2-gov/src/utils/Types.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/UserProxy.sol at commit 168760d750d7051c51f9804b136e1032f7e72f65
  • https://github.com/liquity/v2-gov/src/Governance.sol at commit 1add9a44d62faa8d7ab382d5d00ffcf8f522faee
  • https://github.com/liquity/v2-gov/src/utils/DoubleLinkedList.sol at commit 168760d750d7051c51f9804b136e1032f7e72f65
  • https://github.com/liquity/v2-gov/src/utils/Ownable.sol at commit d11e15a11ebdb26c7b297572d9674a7801f50922
  • https://github.com/liquity/v2-gov/src/BribeInitiative.sol at commit 168760d750d7051c51f9804b136e1032f7e72f65
  • https://github.com/liquity/v2-gov/src/utils/DoubleLinkedList.sol at commit 1add9a44d62faa8d7ab382d5d00ffcf8f522faee
  • https://github.com/liquity/v2-gov/src/UserProxyFactory.sol at commit 1add9a44d62faa8d7ab382d5d00ffcf8f522faee
  • https://github.com/liquity/v2-gov/src/Governance.sol at commit d11e15a11ebdb26c7b297572d9674a7801f50922
  • https://github.com/liquity/v2-gov/src/UserProxyFactory.sol at commit d11e15a11ebdb26c7b297572d9674a7801f50922
  • https://github.com/liquity/v2-gov/src/CurveV2GaugeRewards.sol at commit 168760d750d7051c51f9804b136e1032f7e72f65
  • https://github.com/liquity/v2-gov/src/CurveV2GaugeRewards.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/CurveV2GaugeRewards.sol at commit 1add9a44d62faa8d7ab382d5d00ffcf8f522faee
  • https://github.com/liquity/v2-gov/src/UserProxy.sol at commit d11e15a11ebdb26c7b297572d9674a7801f50922
  • https://github.com/liquity/v2-gov/src/BribeInitiative.sol at commit d11e15a11ebdb26c7b297572d9674a7801f50922
  • https://github.com/liquity/v2-gov/src/Governance.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/utils/Types.sol at commit 1add9a44d62faa8d7ab382d5d00ffcf8f522faee
  • https://github.com/liquity/v2-gov/src/utils/UniqueArray.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/Governance.sol at commit 168760d750d7051c51f9804b136e1032f7e72f65
  • https://github.com/liquity/v2-gov/src/utils/DoubleLinkedList.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/UserProxyFactory.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/utils/UniqueArray.sol at commit d11e15a11ebdb26c7b297572d9674a7801f50922
  • https://github.com/liquity/v2-gov/src/utils/UniqueArray.sol at commit 168760d750d7051c51f9804b136e1032f7e72f65
  • https://github.com/liquity/v2-gov/src/utils/Math.sol at commit 168760d750d7051c51f9804b136e1032f7e72f65
  • https://github.com/liquity/v2-gov/src/utils/Math.sol at commit 1add9a44d62faa8d7ab382d5d00ffcf8f522faee
  • https://github.com/liquity/v2-gov/src/BribeInitiative.sol at commit e7ed5341f2f54fb9bf89497a7be294c61f21ebe3
  • https://github.com/liquity/v2-gov/src/CurveV2GaugeRewards.sol at commit d11e15a11ebdb26c7b297572d9674a7801f50922
  • https://github.com/liquity/v2-gov/src/utils/DoubleLinkedList.sol at commit d11e15a11ebdb26c7b297572d9674a7801f50922
  • https://github.com/liquity/v2-gov/src/utils/Types.sol at commit 168760d750d7051c51f9804b136e1032f7e72f65
  • https://github.com/liquity/v2-gov/src/BribeInitiative.sol at commit 1add9a44d62faa8d7ab382d5d00ffcf8f522faee

Part of Liquity V2’s security record

Liquity V2
Audits3 audits by 1 firmLast audit May 2025, by ChainSecurity.
Critical findingsNo open critical findingsAcross the 3 reports, 3 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Liquity V2’s security record

Security firm

ChainSecurity

81 projects reviewed · 286 reports · latest Sep 2026

See ChainSecurity’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us