LERN360
CredShields reviewed LERNToken (LERN360) (LERN360) on 7 Nov 2025: 29 findings, 6 critical; 22 marked fixed, 7 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings33
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 6 |
| High | 0 | 4 | 6 |
| Medium | 0 | 3 | 5 |
| Low | 0 | 0 | 5 |
CriticalInactive vaults can receive rewards and lock user fundsFixed
The report gives no description here.
CriticalMalicious User Can Drain Rewards When useAPYSystem is TrueFixed
The report gives no description here.
CriticalReward Fund Flow Causing Permanent Token Lock in Staking VaultsFixed
The report gives no description here.
CriticalThe user can claim rewards repeatedly for the same blockFixed
The report gives no description here.
CriticalUser cannot claim from any vault if one vault has no stakeFixed
The report gives no description here.
CriticalUser cannot claim Merkle rewards due to a mismatched recipient checkFixed
The report gives no description here.
HighEarly User Can Drain Later User Stake BalanceFixed
The report gives no description here.
HighReward Cooldown Bypass via Auto-Claim in _stake and withdrawStake FunctionFixed
The report gives no description here.
HighReward Debt Updated Incorrectly Under APY SystemFixed
The report gives no description here.
HighStaker can freeze time-weight and overearn when APY is re-enabledFixed
The report gives no description here.
Show 10 more
HighUser Can Permanently Lose Unpaid Rewards During UnstakeFixed
The report gives no description here.
HighUser can Stake, Claim, and Unstake instantly to get free rewardsFixed
The report gives no description here.
MediumInconsistent Reward Payment Logic Between Unstake and Claim FunctionsFixed
The report gives no description here.
MediumInconsistent Reward State Due to Missing TotalRewards Deduction on ClaimsFixed
The report gives no description here.
MediumManual Rewards Could Be Lost on Emergency WithdrawFixed
The report gives no description here.
MediumTimelock cannot receive vested tokens due to missing vesting integrationFixed
The report gives no description here.
MediumVault pause/unpause functions inaccessible due to factory-admin role assignmentFixed
The report gives no description here.
LowAdmin Can Grant Vesting Role To Arbitrary AddressFixed
The report gives no description here.
LowFloating and Outdated PragmaFixed
The report gives no description here.
LowMissing Upper Bound on APY Rate Allows Arbitrary Reward InflationFixed
The report gives no description here.
Show 2 more
LowUse safeTransfer/safeTransferFrom instead of transfer/transferFromFixed
The report gives no description here.
LowVesting Can Be Created With Cliff Greater Than DurationFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of LERNToken (LERN360)’s security record
LERNToken (LERN360)Security firm
CredShields45 projects reviewed · 58 reports · latest Oct 2026
See CredShields’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us