Merlin Protocol / DAO
Hacken reviewed Merlin Protocol (Merlin Protocol / DAO) on 25 Apr 2024: 28 findings, 0 critical; 22 marked fixed, 6 open.
Report hosted on hacken.io.
Trustblock does not review code.
Findings28
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 0 | 8 |
| Low | 6 | 0 | 11 |
HighchangePercentage() Function Swaps Incorrect AmountFixed
The report gives no description here.
HighExhaustion Attack In Sale Demand May Lead To Incorrect basketRequestsSum ValueFixed
The report gives no description here.
HighFee Manager Can Withdraw Infinitive Fee From the ContractFixed
The report gives no description here.
MediumChainlink’s latestRoundData() Might Return Stale or Incorrect ResultsFixed
The report gives no description here.
MediumFees Are Not Restricted And They Can Be FrontrunnedFixed
The report gives no description here.
MediumIncorrect Balance Update In changePercentage() FunctionFixed
The report gives no description here.
MediumIncorrect Comparison Between Token Amount and USDT Value in closeBasket() FunctionFixed
The report gives no description here.
MediumIncorrect Token Swapping Due to Faulty swapCounter Reset Logic in resetSwapCounter() FunctionFixed
The report gives no description here.
MediumIncorrect Token Swapping in the swap() FunctionFixed
The report gives no description here.
MediumMissing Slippage CheckFixed
The report gives no description here.
Show 10 more
MediumPartial Withdrawal LockFixed
The report gives no description here.
LowInteractions With AMMs Do Not Use Proper Deadlines For OperationsFixed
The report gives no description here.
LowLack of amountOutMinimum Value During Uniswap SwapsFixed
The report gives no description here.
LowLack of Service Type ValidationFixed
The report gives no description here.
LowMissing Checks For address(0) In constructorFixed
The report gives no description here.
LowMissing Zero Value CheckFixed
The report gives no description here.
LowPool Validation of Assets is MissedFixed
The report gives no description here.
LowPrice could return zeroFixed
The report gives no description here.
LowrenounceOwnership() Can Be Called AccidentallyFixed
The report gives no description here.
LowReturn Values Of transfer()/transferFrom() Not CheckedFixed
The report gives no description here.
Show 2 more
LowTesting Tools Are Not Removed From the Production ContractsFixed
The report gives no description here.
LowUnsafe int To uint ConversionFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (13)
- MerlinERC20.sol
- SwapController.sol
- RebalanceController.sol
- MerlinFundModifier.sol
- Lock.sol
- TestFund.sol
- BasketsController.sol
- MerlinFaucet.sol
- MerlinFund.sol
- TokenAllocationController.sol
- Timelock.sol
- MerlinFundAdministrative.sol
- MerlinGovernor.sol
Part of Merlin Protocol’s security record
Security firm
Hacken343 projects reviewed · 476 reports · latest Sep 2026
See Hacken’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us