BENQI Governance Audit Report
Audit · firm’s term: audit report
Cyfrin reviewed BENQI (BENQI Governance Audit Report) on 10 Nov 2025: 11 findings, 0 critical; 4 marked fixed, 7 acknowledged.
No open critical findings
Findings11
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 7 | 4 |
LowArbitrary controller addresses can be passed to Distribution- Manager::setModuleForController without validation of the corresponding gauge addressesAcknowledged
The report gives no description here.
LowBenqiEcosystemModule and UnifiedBudgetAllocator are not fully ERC-165 compliantAcknowledged
The report gives no description here.
LowBudget is always calculated using the full epochDuration regardless of the actual timing of distributionsAcknowledged
The report gives no description here.
LowGauge removal before rewards distribution should be explicitly prevented to avoid erroneous loss of vote weightAcknowledged
The report gives no description here.
LowMaximum number of Aragon DAO actions is not checked within the DistributorManagerAcknowledged
The report gives no description here.
LowMissing interface compliance validation in DistributorManagerAcknowledged
The report gives no description here.
LowSingle rewardToken design is incompatible with multi-reward emission supportAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of BENQI’s security record
BENQIAudits3 audits by 1 firmLast audit Nov 2025, by Cyfrin.
Critical findingsNo open critical findingsAcross 3 reports.
Open BENQI’s security recordSecurity firm
Cyfrin28 projects reviewed · 79 reports · latest Sep 2026
See Cyfrin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us