Gearbox Permissionless Smart Contracts
ChainSecurity reviewed Gearbox (Gearbox Permissionless Smart Contracts) on 1 Aug 2025: 21 findings, 0 critical; all marked fixed.
Report hosted on chainsecurity.com.
Trustblock does not review code.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 7 |
| Medium | 0 | 0 | 8 |
| Low | 0 | 0 | 6 |
HighCannot Forbid an Adapter With Normal ConfigurationFixed
The report gives no description here.
HighFactory Migration Will FailFixed
The report gives no description here.
HighLegacy CreditManager Cannot Be Fully ConfiguredFixed
The report gives no description here.
HighOverwritten Version in AddressProviderFixed
The report gives no description here.
HighReverting Proposals Lock Cross-Chain GovernanceFixed
The report gives no description here.
HighTimelock Transactions Can Be Executed Before the ETAFixed
The report gives no description here.
HighUpdating a Rate Keeper Will Freeze the EpochFixed
The report gives no description here.
MediumBatching disableRecoveryMode Can Be ProblematicFixed
The report gives no description here.
MediumDynamic Types Must Be Hashed for EIP712Fixed
The report gives no description here.
MediumFree Choice of maxEnabledTokens Can Be DangerousFixed
The report gives no description here.
Show 10 more
MediumLegacy PriceOracle Cannot Be UpdatedFixed
The report gives no description here.
MediumMissing Sanity Checks on minorVersionFixed
The report gives no description here.
MediumRecovery Mode Message ReplayFixed
The report gives no description here.
MediumShutting Down a Market ConfiguratorFixed
The report gives no description here.
MediumThreshold Not Enforced When Removing SignerFixed
The report gives no description here.
LowA Transaction Can Be Canceled After ExecutionFixed
The report gives no description here.
LowAllowance Timestamp Can Be ResetFixed
The report gives no description here.
LowEnough Admins CheckFixed
The report gives no description here.
LowForbidden initCodeFixed
The report gives no description here.
LowPending OwnersFixed
The report gives no description here.
Show 1 more
LowWrong SpecificationsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (32)
- CallBuilder.sol
- Governor.sol
- PriceFeedStore.sol
- InstanceManager.sol
- AbstractMarketFactory.sol
- Domain.sol
- DefaultLossPolicy.sol
- RateKeeperFactory.sol
- PoolFactory.sol
- ContractsRegister.sol
- DefaultDegenNFT.sol
- AbstractFactory.sol
- MarketConfigurator.sol
- ACL.sol
- MarketConfiguratorFactory.sol
- PriceOracleFactory.sol
- InterestRateModelFactory.sol
- ContractLiterals.sol
- DefaultIRM.sol
- CreditFactory.sol
- LossPolicyFactory.sol
- TreasurySplitter.sol
- CrossChainMultisig.sol
- NestedPriceFeeds.sol
- AddressProvider.sol
- MarketConfiguratorLegacy.sol
- EIP712Mainnet.sol
- ProxyCall.sol
- DeployerTrait.sol
- TimeLock.sol
- BytecodeRepository.sol
- ImmutableOwnableTrait.sol
Part of Gearbox’s security record
GearboxSecurity firm
ChainSecurity81 projects reviewed · 286 reports · latest Sep 2026
See ChainSecurity’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us