Audit Report (Staking)
Paladin reviewed Sculptor Finance (Audit Report (Staking)) on 13 Jun 2022: 43 findings, 0 critical; 19 marked fixed, 20 acknowledged, 4 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings43
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 6 |
| Medium | 3 | 1 | 4 |
| Low | 1 | 19 | 9 |
HighEach MasterChef pool requires their own incentives controllerFixed
The report gives no description here.
HighMultiFeeDistribution contract does not have a function that matches the interface lockedBalancesFixed
The report gives no description here.
HighonwardIncentives call in emergencyWithdraw is vulnerable to gas griefing which potentially allows the user to amplify onwardIncentives rewardsFixed
The report gives no description here.
HighonwardIncentives lacks quality and its interface does not match the ChefIncentivesController handleAction functionFixed
The report gives no description here.
HighPair value can be significantly manipulated to sell to the protocol in a sandwich attackFixed
The report gives no description here.
HighunlockDuration relocks claiming for all receivers instead of just the receiver who called claimFixed
The report gives no description here.
MediumChecks-effects-interactions is not adhered to throughout the contract, allowing for reward tokens to be stolen in case a token permits reentrancyFixed
The report gives no description here.
MediumDeposits do not support tokens with a fee on transferFixed
The report gives no description here.
MediumhandleAction is not compliant with the onwardIncentives interface and pases a strange parameter to the functionFixed
The report gives no description here.
MediumSeveral functions lack nonReentrantFixed
The report gives no description here.
Show 9 more
LowChecks-effects-interactions is not adhered toFixed
The report gives no description here.
Lowfor loop in constructor underflowsFixed
The report gives no description here.
LowGov privilege: User stakes could become locked if governance sets a bad onwardIncentives for a poolFixed
The report gives no description here.
LowhandleAction() is callable by anyoneFixed
The report gives no description here.
LowLack of event for addPoolFixed
The report gives no description here.
LowLack of events for start, claim and constructor vester addingFixed
The report gives no description here.
LowMinor errors, gas optimizations and improvementsFixed
The report gives no description here.
LowPurchases round in favor of the userFixed
The report gives no description here.
LowRounding vulnerability to tokens with a very large supply can cause large supply tokens to receive zero emissionsFixed
The report gives no description here.
Contracts in scope5
| Address | Chain | Source code |
|---|---|---|
| 0xe482676c4daa5156178c2e693c38e937521e9656 | Chain: BNB Chain | Source code: Verified source |
| 0xd4f7f739488f5c9930a60e85afbe26a8b71ba795 | Chain: BNB Chain | Source code: Verified source |
| 0x19a392f8fa8ffee07106200236f5b7078860d51c | Chain: BNB Chain | Source code: Verified source |
| 0x18542eee45272a29bc572f0edb727da4e3506dd2 | Chain: BNB Chain | Source code: Verified source |
| 0xad3e02e83b886543d1171ff446c130d52068c106 | Chain: BNB Chain | Source code: Verified source |
Part of Sculptor Finance’s security record
Sculptor FinanceSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us