Audit Report
Paladin reviewed OrcaDAO (Audit Report) on 28 Oct 2021: 58 findings, 0 critical; 23 marked fixed, 33 acknowledged, 2 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings58
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 2 | 2 |
| Low | 2 | 31 | 18 |
MediumendTimestamp logic is wrong causing the farm to stop emitting rewards to lateAcknowledged
The report gives no description here.
MediumGovernance privilege: No restrictions on deposit feesAcknowledged
The report gives no description here.
Low_orca, _revocable and revoked should be marked as publicAcknowledged
The report gives no description here.
LowAdding a EOA or non-token contract as a pool will break updatePool and massUpdatePoolsAcknowledged
The report gives no description here.
LowAmbiguous naming of treasury vaultAcknowledged
The report gives no description here.
LowAnyone can call a release which might be annoying for the recipient their accountingAcknowledged
The report gives no description here.
LowCalling release before the cliff results in an ambiguous underflow reversionAcknowledged
The report gives no description here.
LowdebtRatio and gainRatio have ambiguous namesAcknowledged
The report gives no description here.
LowdebtRatio can only be set to very distinct values without much flexibilityAcknowledged
The report gives no description here.
LowDeflationary tokens are not supportedAcknowledged
The report gives no description here.
Show 10 more
LowEvent parameters are not indexedAcknowledged
The report gives no description here.
LowGas optimization: roles can be cachedAcknowledged
The report gives no description here.
LowGas optimization: roles can be cachedAcknowledged
The report gives no description here.
LowhalfDebt is a misnomerAcknowledged
The report gives no description here.
LowLack of explicit check to validate that the vault is in fact a WAVAX vaultAcknowledged
The report gives no description here.
LowopeningFee is unusedAcknowledged
The report gives no description here.
LowOrca and startTimestamp can be made immutableAcknowledged
The report gives no description here.
LowpendingRewards and updatePool reverts while totalAllocPoint is zeroAcknowledged
The report gives no description here.
Lowpermit and delegateBySig can be frontrun causing denial of serviceAcknowledged
The report gives no description here.
LowPrecision vulnerability causes insufficient rewards for certain tokensAcknowledged
The report gives no description here.
Show 10 more
LowsetRewardsPerSecond updates historical rewards since the last pool activity as wellAcknowledged
The report gives no description here.
LowsetTreasury and rewardsActive can be made externalAcknowledged
The report gives no description here.
LowsupportsInterface does not return true on all supported interfacesAcknowledged
The report gives no description here.
LowThe changedAddress event is unusedAcknowledged
The report gives no description here.
LowThe contract malfunctions when teammates are added while payments have already been releasedAcknowledged
The report gives no description here.
LowThe receive function is unusedAcknowledged
The report gives no description here.
LowTip: Tracking the debt ceiling within the AVAI contract might be saferAcknowledged
The report gives no description here.
LowtotalShares, totalReleased, shares, released, payee, addPayee and release can be made externalAcknowledged
The report gives no description here.
LowTreasury can be set to the zero address potentially blocking both deposits and withdrawalsAcknowledged
The report gives no description here.
LowTypographical error in the contractAcknowledged
The report gives no description here.
Show 3 more
LowTypographical errors in the contractAcknowledged
The report gives no description here.
LowUsing the term vault for the bank address is a misnomerAcknowledged
The report gives no description here.
LowWrongful usage of assertAcknowledged
The report gives no description here.
Contracts in scope11
| Address | Chain | Source code |
|---|---|---|
| 0x4422fb9afb547e8ed7a61ac9de0255c760ea55c1 | Chain: Avalanche | Source code: Verified source |
| 0x599d8908f783df097e390e0f53d5f93b68f1126a | Chain: Avalanche | Source code: Verified source |
| 0x7352ef87724e1725595add3ca2a9820775fb41d2 | Chain: Avalanche | Source code: Verified source |
| 0x4fffa5602112fd0c7b327a503f67f229f6d0828a | Chain: Avalanche | Source code: Verified source |
| 0x318dfbe56155f9999fa913cddcaa5764a2b52134 | Chain: Avalanche | Source code: Verified source |
| 0xc029713e92383426c9b387b124c0bf6271d08b80 | Chain: Avalanche | Source code: Verified source |
| 0x346a59146b9b4a77100d369a3d18e8007a9f46a6 | Chain: Avalanche | Source code: Verified source |
| 0x8b1d98a91f853218ddbb066f20b8c63e782e2430 | Chain: Avalanche | Source code: Verified source |
| 0x1ea60d781376c06693dfb21d7e5951caec13f7e4 | Chain: Avalanche | Source code: Verified source |
| 0x4805d6563b36a02c5012c11d6e15552f50066d58 | Chain: Avalanche | Source code: Verified source |
Show the other 1 addresses
| Address | Chain | Source code |
|---|---|---|
| 0x111e1e97435b57467e79d4930acc4b7eb3d478ad | Chain: Avalanche | Source code: Verified source |
Part of OrcaDAO’s security record
Security firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us