Audit Report
Paladin reviewed GalaxyGoogle DAO (Audit Report) on 17 Jan 2022: 56 findings, 0 critical; 7 marked fixed, 49 acknowledged.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings56
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 2 | 1 |
| Medium | 0 | 1 | 2 |
| Low | 0 | 46 | 4 |
HighStaked amount is relocked on subsequent stakes, even if the stake is made by third-parties allowing for targeted Denial of ServiceAcknowledged
The report gives no description here.
HighVested amount is relocked on deposit, even if the deposit is made by third-parties allowing for targeted Denial of ServiceAcknowledged
The report gives no description here.
MediumThe last owner can be reclaimed across multiple contractsAcknowledged
The report gives no description here.
Low_burnFrom is marked as publicAcknowledged
The report gives no description here.
LowAdding a token as both a liquidity and reserve token would cause it to be double counted in the treasury valueAcknowledged
The report gives no description here.
LowAdjustment target is never reachedAcknowledged
The report gives no description here.
LowAdjustment target is never reachedAcknowledged
The report gives no description here.
LowAdjustments are not reset when recipient is removedAcknowledged
The report gives no description here.
LowAmbiguous errorsAcknowledged
The report gives no description here.
LowbondPrice calculation is inconsistent with TimeBondDepositoryAcknowledged
The report gives no description here.
Show 10 more
LowbondPriceInUSD is denominated in the decimals of the other token in the LP and might not be correct for non-stablecoin LPsAcknowledged
The report gives no description here.
LowContract could theoretically run out of GGAcknowledged
The report gives no description here.
LowContract does not work with a zero vestingTermAcknowledged
The report gives no description here.
Lowdeposit is vulnerable to reentrancy if the principle has a reentrancy vectorAcknowledged
The report gives no description here.
LowDOMAIN_SEPARATOR can be made immutableAcknowledged
The report gives no description here.
LowGas optimization: Contract uses hardcoded strings in SafeMath functionsAcknowledged
The report gives no description here.
LowGas optimization: Storage variables are frequently unnecessarily rereadAcknowledged
The report gives no description here.
LowGas optimization: Usage of decimals as a precision multiplierAcknowledged
The report gives no description here.
LowInconsistency: Unused mint function emits an event from address(this) while the mint logic during initialization emits an event from the zero addressAcknowledged
The report gives no description here.
LowInfrequent rebases incentivize malicious parties to strategically (re)order transactions for arbitrage and steal all rebased tokens off the LP pairsAcknowledged
The report gives no description here.
Show 10 more
LowinitializeBondTerms has no validationAcknowledged
The report gives no description here.
LowLack of component safeguards in a system that plans to increase in number of components over time is considered brittleAcknowledged
The report gives no description here.
LowLack of events for various functionsAcknowledged
The report gives no description here.
LowLack of safeTransfer usage within incurDebtAcknowledged
The report gives no description here.
LowLack of validationAcknowledged
The report gives no description here.
LowManage will always do an excessReserve check even if the token is not within the liquidity or reserves tokensAcknowledged
The report gives no description here.
LowMarkdown will misbehave if an LP with two non-GG tokens is providedAcknowledged
The report gives no description here.
LowNew owner variable is privateAcknowledged
The report gives no description here.
Lowpermit can be frontrun and cause denial of serviceAcknowledged
The report gives no description here.
LowPhishing: Frontend could trick users into sending too much BNB for depositsAcknowledged
The report gives no description here.
Show 10 more
LowPhishing: stake function allows to stake towards a different addressAcknowledged
The report gives no description here.
LowpriceFeed is internalAcknowledged
The report gives no description here.
LowRebases can be arbitraged/frontranAcknowledged
The report gives no description here.
LowrepayDebtWithOhm has inconsistent privilege requirements which allows for slight privilege escalationAcknowledged
The report gives no description here.
LowReserve value mechanism could cause withdrawals and other operations to temporarily failAcknowledged
The report gives no description here.
LowThe contracts become unusable in the year 2106Acknowledged
The report gives no description here.
LowThe contracts do not work with tax on transfer tokensAcknowledged
The report gives no description here.
LowThe protocol will likely malfunction if ChainLink feeds for BNB will be different than 8 decimalsAcknowledged
The report gives no description here.
LowTimeBondingCalculator can only value pairs in which the two tokens have equal “value”Acknowledged
The report gives no description here.
LowTransactionless approval permit mechanism still references zero swapAcknowledged
The report gives no description here.
Show 9 more
LowTypographical errorsAcknowledged
The report gives no description here.
LowUI markdown function is vulnerable to price manipulationAcknowledged
The report gives no description here.
LowUnbounded gas usage due to extensive for-loop usageAcknowledged
The report gives no description here.
LowUncast addresses make the code more verbose than it needs to beAcknowledged
The report gives no description here.
LowUnder a constant and small circulating supply, the non-circulating supply starts increasing more rapidly with every rebaseAcknowledged
The report gives no description here.
LowUnnecessary comparison to true on withdraw functionAcknowledged
The report gives no description here.
LowUnused variables/dependencies throughout the contractsAcknowledged
The report gives no description here.
LowVarious functions can be made externalAcknowledged
The report gives no description here.
LowVault can be set to the zero addressAcknowledged
The report gives no description here.
Contracts in scope13
| Address | Chain | Source code |
|---|---|---|
| 0xe4677ba3fc3cbb92633e6c636f073e76f3a76a61 | Chain: BNB Chain | Source code: Verified source |
| 0xcaf23964ca8db16d816eb314a56789f58fe0e10e | Chain: BNB Chain | Source code: Verified source |
| 0xf76c9753507b3df0867eb02d86d07c6ffceecaf1 | Chain: BNB Chain | Source code: Verified source |
| 0x43ea89c2ea35bfb44536623a2a0d6b54729258b3 | Chain: BNB Chain | Source code: Verified source |
| 0xb18b51de676f466e3758f9e3b0739cba564c7209 | Chain: BNB Chain | Source code: Verified source |
| 0x137d4755071844dce186ad6df8c07e017137d3c7 | Chain: BNB Chain | Source code: Verified source |
| 0x4d60c0b9ec47440e412a8080cc040a9364e1eab4 | Chain: BNB Chain | Source code: Verified source |
| 0xa1fdcb89c02b7cf17676ce376cfdca841ae5d840 | Chain: BNB Chain | Source code: Verified source |
| 0x50a0dde8734ac2b68013825fce6958bbbf86dac2 | Chain: BNB Chain | Source code: Verified source |
| 0x2863c5d73510c671f5d16687bdffcc3de6f14576 | Chain: BNB Chain | Source code: Verified source |
Show the other 3 addresses
| Address | Chain | Source code |
|---|---|---|
| 0x98868eba22ce858a19d67e984211fa80ab74df8b | Chain: BNB Chain | Source code: Verified source |
| 0xcc2e2134b74c70acd64bb297d18ba25087789d8d | Chain: BNB Chain | Source code: Verified source |
| 0x97209cf7a6fccc388eeff85b35d858756f31690d | Chain: BNB Chain | Source code: Verified source |
Part of GalaxyGoogle DAO’s security record
Security firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us