Reserve Updates audit
Audit · firm’s term: security audit
Oak Security reviewed Reserve (Reserve Updates audit) on 12 Mar 2026: 4 findings, 0 critical; all acknowledged, none fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings4
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 4 | 0 |
Marked Informational by the firm. Not counted as findings.
InformationalAerodrome and Curve gauge wrapper constructors lack validation of the provided tokensAcknowledged
The report gives no description here.
InformationalCFiatV3Wrapper.multiplier has no input validationAcknowledged
The report gives no description here.
InformationaldeprecateVersion does not verify version existenceAcknowledged
The report gives no description here.
InformationalDeprecation of versions and assets is irreversibleAcknowledged
The report gives no description here.
InformationalDuplicate error code Err(5) in Upgrade4_2_0Acknowledged
The report gives no description here.
InformationalDust-amount unstakes create zero-value draft queue entriesAcknowledged
The report gives no description here.
InformationalIncorrect NatSpec return documentation in IDeployerAcknowledged
The report gives no description here.
InformationalLack of zero address check in redeemCustomAcknowledged
The report gives no description here.
InformationalMiscellaneous documentation concernsAcknowledged
The report gives no description here.
InformationalMisleading comment in GnosisTrade's settle function implies an explicit time check that does not existAcknowledged
The report gives no description here.
Show 9 more
InformationalMissing destination validation in _setDistributionAcknowledged
The report gives no description here.
InformationalMissing events for registry state changesAcknowledged
The report gives no description here.
InformationalOutdated AerodromeStakingWrapper wrapper name referenced in Aerodrome plugin documentationAcknowledged
The report gives no description here.
InformationalPublic _bidAmount function uses underscore prefix naming convention reserved for internal visibilityAcknowledged
The report gives no description here.
InformationalRegistry references could be declared immutable for gas savingsAcknowledged
The report gives no description here.
InformationalRoleRegistry uses deprecated _setupRoleAcknowledged
The report gives no description here.
InformationalStale sell token allowance persists after closing a trusted fillAcknowledged
The report gives no description here.
InformationalThe trusted filler registry, once initially set, isAcknowledged
The report gives no description here.
InformationalTrustedFillerRegistrySet event has inconsistent emission and formattingAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Reserve’s security record
ReserveSecurity firm
Oak Security33 projects reviewed · 60 reports · latest May 2026
See Oak Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us