Ostium security review
Audit · firm’s term: security review
Pashov Audit Group reviewed Ostium (Ostium security review) on 11 Oct 2025: 36 findings, 0 critical; all acknowledged, none fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings36
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 4 | 0 |
| Medium | 0 | 11 | 0 |
| Low | 0 | 21 | 0 |
HighCode does not scale accPnlPerToken in scaleVariables() alwaysAcknowledged
The report gives no description here.
HighCode misses sending rollover fee to liquidity bufferAcknowledged
The report gives no description here.
HighFunction unlockDeposit() adds discounted assets as traders profit and lossAcknowledged
The report gives no description here.
HighLP providers will not get liquidation fee most timesAcknowledged
The report gives no description here.
MediumAttacker can front-run unrealized PnL as they take effect at the end of epochAcknowledged
The report gives no description here.
MediumCode does not reset orderTriggerBlock when updating tradesAcknowledged
The report gives no description here.
MediumDeposit/withdraw should not change share priceAcknowledged
The report gives no description here.
MediumdepositWithDiscountAndLock() and mintWithDiscountAndLock() lack slippage checkAcknowledged
The report gives no description here.
MediumDiscrepancy for isLiquidated in trade and automation callbacksAcknowledged
The report gives no description here.
MediumFront-running unlockDeposit() can avoid loss distributionAcknowledged
The report gives no description here.
Show 10 more
MediumgetDynamicTradePriceImpact() does not use bid/ask as base priceAcknowledged
The report gives no description here.
MediumInconsistent price impact calculationsAcknowledged
The report gives no description here.
MediumOrders related to a trade may be executed to replaced tradeAcknowledged
The report gives no description here.
MediumupdateAccPnlPerTokenUsed() only applies positive unrealized PnLAcknowledged
The report gives no description here.
MediumUsing average for unrealized PnL settlement gives opportunity to extract valueAcknowledged
The report gives no description here.
LowAllowance bypass in makeWithdrawRequest() and cancelWithdrawRequest()Acknowledged
The report gives no description here.
LowClaiming fees in excess can revert oracle fee refundsAcknowledged
The report gives no description here.
LowDeposit and mint functions may validate against outdated max supplyAcknowledged
The report gives no description here.
LowFunction updateAccTotalPnl() only get called if a trade is executedAcknowledged
The report gives no description here.
LowFunctions topUpCollateral() and removeCollateral() should round in favor of poolAcknowledged
The report gives no description here.
Show 10 more
LowInconsistent maximum group collateral checkAcknowledged
The report gives no description here.
LowInflation attack in OstiumVaultAcknowledged
The report gives no description here.
LowNo makerFeeP < takerFeeP validation in setPairOpeningFees()Acknowledged
The report gives no description here.
LowNo prevention in transfer / transferFrom for withdrawing addressAcknowledged
The report gives no description here.
LowNo zero address check in registerAuthorizedSigner()Acknowledged
The report gives no description here.
LowperformUpkeep errors if price timestamp exceeds block timestampAcknowledged
The report gives no description here.
LowPossible index collision in builder dataAcknowledged
The report gives no description here.
LowremovePair() can be DOS by a malicious userAcknowledged
The report gives no description here.
LowRounding in mintWithDiscountAndLock() grants larger discountAcknowledged
The report gives no description here.
LowStale pricestamps can allow backdated executionsAcknowledged
The report gives no description here.
Show 6 more
LowtryUpdateCurrentMaxSupply may unexpectedly decrease currentMaxSupplyAcknowledged
The report gives no description here.
LowtryUpdateCurrentMaxSupply() does not use maxSupplyIncreaseDailyPAcknowledged
The report gives no description here.
LowupdateAccTotalPnl() callable only on tradesAcknowledged
The report gives no description here.
LowupdateOpenLimitOrder() may incorrectly alter limit order parametersAcknowledged
The report gives no description here.
LowUpdating oracleFee might risk DOS in closeTradeMarketTimeout()Acknowledged
The report gives no description here.
LowUpgrade of OstiumLockedDepositNft.sol may block user share claimsAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Ostium’s security record
OstiumSecurity firm
Pashov Audit Group86 projects reviewed · 165 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us