Audit Report
Paladin reviewed OrcaDAO (Audit Report) on 28 Oct 2021: 58 findings, 0 critical; 23 marked fixed, 33 acknowledged, 2 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings58
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 3 |
| Medium | 0 | 2 | 2 |
| Low | 2 | 31 | 18 |
HighGov Privilege: Governance can change crucial aspects of the protocol to potentially drain the contracts of all supplied tokensFixed
The report gives no description here.
HighGovernance privilege: The USDCExchange can be upgraded or configured to potentially take all USDC and minted AVAIFixed
The report gives no description here.
HighThe protocol will likely malfunction for collateral tokens with decimals different than 18 tokens and ChainLink feeds different than 8 decimalsFixed
The report gives no description here.
MediumOnce a stability pool is added, only the stability pool can liquidateFixed
The report gives no description here.
MediumOwner of the VestingWallet can withdraw all unvested tokensFixed
The report gives no description here.
LowchangeTreasury allows changing the treasury to the zero addressFixed
The report gives no description here.
LowcheckLiquidation reverts instead of returning a booleanFixed
The report gives no description here.
LowDeflationary tokens are not supported as collateralFixed
The report gives no description here.
LowdestroyVaults does not adhere to checks-effects-interactions which could allow an exploiter to abuse third-party contracts if a bank an ERC-777 (or similar) token is ever addedFixed
The report gives no description here.
LowGas optimization: AVAI can be burned directly during liquidationsFixed
The report gives no description here.
Show 10 more
LowGas optimization: AVAI can be burned directly during redemptionFixed
The report gives no description here.
LowgetPriceSource underflows if ChainLink ever returns a negative price by errorFixed
The report gives no description here.
LowGov privilege: The gateway address is very privileged throughout the systemFixed
The report gives no description here.
LowLack of events for changeTreasury, setGainRatio, setDebtRatio, setDebtCeiling, setPriceSource, setTokenPeg, setStabilityPool, setGateway, setClosingFee, setOpeningFeeFixed
The report gives no description here.
LowLack of events for changeTreasury, setUSDCRate, setAVAIRate and setTreasuryFixed
The report gives no description here.
LowLack of events for setGateway, setStabilityPool, setPriceSource and setTreasuryFixed
The report gives no description here.
LowLack of maximum mint could be disastrous if USDC loses pegFixed
The report gives no description here.
LowLack of parameter validationFixed
The report gives no description here.
LowNo minimum debt amountFixed
The report gives no description here.
LowRedundant hasRole requirementsFixed
The report gives no description here.
Show 3 more
LowThe treasury that receives fees can be set to the zero address preventing minting and redeeming of AVAIFixed
The report gives no description here.
LowThere are a few typographical errors within the contractFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
Contracts in scope11
| Address | Chain | Source code |
|---|---|---|
| 0x4422fb9afb547e8ed7a61ac9de0255c760ea55c1 | Chain: Avalanche | Source code: Verified source |
| 0x599d8908f783df097e390e0f53d5f93b68f1126a | Chain: Avalanche | Source code: Verified source |
| 0x7352ef87724e1725595add3ca2a9820775fb41d2 | Chain: Avalanche | Source code: Verified source |
| 0x4fffa5602112fd0c7b327a503f67f229f6d0828a | Chain: Avalanche | Source code: Verified source |
| 0x318dfbe56155f9999fa913cddcaa5764a2b52134 | Chain: Avalanche | Source code: Verified source |
| 0xc029713e92383426c9b387b124c0bf6271d08b80 | Chain: Avalanche | Source code: Verified source |
| 0x346a59146b9b4a77100d369a3d18e8007a9f46a6 | Chain: Avalanche | Source code: Verified source |
| 0x8b1d98a91f853218ddbb066f20b8c63e782e2430 | Chain: Avalanche | Source code: Verified source |
| 0x1ea60d781376c06693dfb21d7e5951caec13f7e4 | Chain: Avalanche | Source code: Verified source |
| 0x4805d6563b36a02c5012c11d6e15552f50066d58 | Chain: Avalanche | Source code: Verified source |
Show the other 1 addresses
| Address | Chain | Source code |
|---|---|---|
| 0x111e1e97435b57467e79d4930acc4b7eb3d478ad | Chain: Avalanche | Source code: Verified source |
Part of OrcaDAO’s security record
Security firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us