Audit Report
Paladin reviewed FarmersOnly Layer 2 (Audit Report) on 18 Oct 2021: 30 findings, 0 critical; 27 marked fixed, 2 acknowledged, 1 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings30
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 2 |
| Low | 1 | 2 | 23 |
HighIf the staked token is equal to the reward token, the owner can drain the staked tokens with emergencyRewardWithdrawFixed
The report gives no description here.
HighThe reward distribution mechanism is wrongly definedFixed
The report gives no description here.
MediumMaximum supply cap logic is wrongly defined, causing the token to mint either too much or too little potentially causing deposits and withdrawals to revertFixed
The report gives no description here.
MediumThe deposit, withdraw and emergencyWithdraw functions do not have reentrancy guardsFixed
The report gives no description here.
LowAdding an EOA or a non-token contract as a pool will break updatePool, massUpdatePools and updateEmissionRateFixed
The report gives no description here.
LowContract contains unused referral code mechanism which could be accidentally set to block depositsFixed
The report gives no description here.
LowContracts contains multiple occurrences of code that has been commented outFixed
The report gives no description here.
Lowdeposit, withdraw, set, emergencyWithdraw, setStartTime, updateEmissionRate, setFeeAddress, dev and getHarvestUntil functions can be made externalFixed
The report gives no description here.
LowLack of events for setRewardPerTime and setBonusEndTimeFixed
The report gives no description here.
LowMAX_EMISSION_RATE and EMISSION_RATE can be declared as a constantFixed
The report gives no description here.
Show 10 more
Lowmint function can be used to pre-mint large amounts of tokens before ownership is transferred to the MasterchefFixed
The report gives no description here.
Lowmsg.sender is unnecessarily cast to address(msg.sender)Fixed
The report gives no description here.
LowSetting devAddress and feeAddress to the zero address will break updatePool and deposit functionality respectivelyFixed
The report gives no description here.
LowstakeToken, rewardToken and startTime can be declared as a immutableFixed
The report gives no description here.
LowThe BONUS_MULTIPLIER variable is not functionalFixed
The report gives no description here.
LowThe deposit and withdraw functions can be made externalFixed
The report gives no description here.
LowThe msg.sender is unnecessarily cast to address(msg.sender)Fixed
The report gives no description here.
LowThe pendingTomato function will revert if totalAllocPoint is zeroFixed
The report gives no description here.
LowThe poolInfo is unnecessarily declared as an array making totalAllocPoint redundant as wellFixed
The report gives no description here.
LowThe set function error still references the add functionFixed
The report gives no description here.
Show 7 more
LowThe setRewardPerTime function can be set to an excessive emission rateFixed
The report gives no description here.
LowThe setRewardPerTime should include an updatePool(0); before the changeFixed
The report gives no description here.
LowThe StartTimeChanged event wrongly emittedFixed
The report gives no description here.
LowThe updatePool function will revert if totalAllocPoint is zeroFixed
The report gives no description here.
LowThere are no sanity checks in the setReferralAddress functionFixed
The report gives no description here.
Lowtomato can be declared as immutableFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
Contracts in scope2
| Address | Chain | Source code |
|---|---|---|
| 0xf5760bbbc3565f6a513a9c20300a335a1250c57e | Chain: Avalanche | Source code: Verified source |
| 0x8bef31c1e0ac12d73842a49436458fd586c22a58 | Chain: Avalanche | Source code: Verified source |
Part of FarmersOnly Layer 2’s security record
Security firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us