Audit Report
Paladin reviewed Taco Party – Salsa Edition (Audit Report) on 19 Nov 2021: 35 findings, 0 critical; 26 marked fixed, 7 acknowledged, 2 open.
Trustblock does not review code.
Findings35
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 2 |
| Medium | 0 | 0 | 2 |
| Low | 1 | 7 | 22 |
HighGenerated liquidity is sent to the operator which could potentially dump itFixed
The report gives no description here.
HighupdateSalsaSwapRouter could be used to break transfer and siphon all transfer taxesFixed
The report gives no description here.
MediumGov privilege: Lack of lower limit on minAmountToLiquify potentially breaking transfersFixed
The report gives no description here.
MediumMax supply check does not account for dev rewardFixed
The report gives no description here.
Low_isExcludedFromFee is privateFixed
The report gives no description here.
LowContract wrongly increments the bunny count on burn instead of decrementing itFixed
The report gives no description here.
LowLack of end block validation on mintNFTFixed
The report gives no description here.
LowLack of events for excludeFromFee and includeInFeeFixed
The report gives no description here.
LowLack of events for setStartBlockNumber, whitelistAddresses, withdrawSalsa and changeOwnershipNFTContractFixed
The report gives no description here.
LowLack of events for setUSDCSalsaLPAddress and updateEmissionParametersFixed
The report gives no description here.
Show 10 more
Lowmint, excludeFromFee, includeInFee, setMinAmountToLiquify, updateSwapAndLiquifyEnabled, updateSalsaSwapRouter and transferOperator can be made externalFixed
The report gives no description here.
Lowmsg.sender is unnecessarily cast to address(msg.sender)Fixed
The report gives no description here.
Lowmsg.sender is unnecessarily cast to address(msg.sender)Fixed
The report gives no description here.
LownumberOfBunnyIds can be made constantFixed
The report gives no description here.
LowsalsaAddress and hasBurnedUnsoldPresale are privateFixed
The report gives no description here.
LowsalsaBunnies, salsaToken, endBlockNumber, salsaPerBurn and totalSupplyDistributed can be made immutableFixed
The report gives no description here.
LowsalsaMaximumSupply can be made constantFixed
The report gives no description here.
LowsetEmissionRate is redundant to updateEmissionRateFixed
The report gives no description here.
LowsetEmissionRate, setUSDCSalsaLPAddress, updateEmissionParameters and updateEmissionRate can be made externalFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
Show 6 more
LowUnused ContextMixinFixed
The report gives no description here.
LowUnused variable: redeemStateFixed
The report gives no description here.
LowUnused variable: startBlockNumberFixed
The report gives no description here.
LowUsage of require when assert is more appropriateFixed
The report gives no description here.
Lowusdc can be made immutableFixed
The report gives no description here.
Lowuser.lastWithdraw is not set on emergencyWithdrawFixed
The report gives no description here.
Contracts in scope7
| Address | Chain | Source code |
|---|---|---|
| 0xbbf6eb02755b8c3e9470cc03c5526401ec0abc0f | Chain: Polygon (POS) | Source code: Verified source |
| 0x97a53314041a689956ce66bb74907fccebaf001f | Chain: Polygon (POS) | Source code: Verified source |
| 0x9c0f8e9796a334c7b95551dbecdadd43f7d87217 | Chain: Polygon (POS) | Source code: Verified source |
| 0x64367c7a9e91da86386964dcffecf0ec48d2fbc0 | Chain: Polygon (POS) | Source code: Verified source |
| 0xde1c7b7126aada7bbadb28c79c5fb20ba667b85f | Chain: Polygon (POS) | Source code: Verified source |
| 0xea3b6da2031df019ee48ee982e284dd4dcbbcc31 | Chain: Polygon (POS) | Source code: Verified source |
| 0x1e0a8f47e894d5a77f300935a33381164308ba81 | Chain: Polygon (POS) | Source code: Verified source |
Part of Taco Party – Salsa Edition’s security record
Taco Party – Salsa EditionSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us