Audit Report
Paladin reviewed CIAN Protocol (Audit Report) on 25 Oct 2022: 93 findings, 0 critical; 74 marked fixed, 12 acknowledged, 7 open.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings93
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 6 |
| Medium | 1 | 0 | 13 |
| Low | 5 | 12 | 55 |
High_multiCall does not validate that the _certifiedAddress is unset after the individual iterations are fulfilled allowing a malicious operator to drain and even destroy user proxiesFixed
The report gives no description here.
HighGovernance Issue: The implementation is a proxyFixed
The report gives no description here.
HighLack of authentication on flashLoan callFixed
The report gives no description here.
HighrecoverSigner allows anyone to fake signatures for the zero addressFixed
The report gives no description here.
HighSAVAX redemptions might eventually relock or run out of gasFixed
The report gives no description here.
HighSELFDESTRUCT can potentially be executed on an uninitialized implementationFixed
The report gives no description here.
MediumAny authorized address can become the only authorized addressFixed
The report gives no description here.
MediumApproval flow does not contain necessary safeguardsFixed
The report gives no description here.
MediumGovernance privilege: balanceController can take funds from users’ accountsFixed
The report gives no description here.
MediumGovernance privilege: The timelock could be used to steal users’ tokensFixed
The report gives no description here.
Show 10 more
MediumGovernance privilege: The timelock could be used to steal users’ tokensFixed
The report gives no description here.
MediumonFlashLoan callback is vulnerable to reentrancyFixed
The report gives no description here.
MediumOperations do not revert if underlying protocols are pausedFixed
The report gives no description here.
MediumPhishing risk: Malicious admins can be usedFixed
The report gives no description here.
Mediumrepay may use an outdated valueFixed
The report gives no description here.
MediumThe initiator address of the onFlashLoan is not reliableFixed
The report gives no description here.
MediumThe removeAuth function can be called multiple time with the same valuesFixed
The report gives no description here.
MediumUser can get sandwiched and suffer high slippageFixed
The report gives no description here.
MediumValidation on withdrawAssetsToAccount is almost completely uselessFixed
The report gives no description here.
Low_paused and suspendPermissions are privateFixed
The report gives no description here.
Show 10 more
LowadapManager, advancedOptionEnable and CertifiedAddress are privateFixed
The report gives no description here.
LowaddLiquidityAVAX contains a seemingly redundant transferFixed
The report gives no description here.
Lowapprovals, approve and revoke can be made externalFixed
The report gives no description here.
LowbalanceController and feeReceiver are privateFixed
The report gives no description here.
LowBankerJoeAdapter: Unused events — TraderJoeStake and TraderJoeUnstakeFixed
The report gives no description here.
LowBankerJoeAdapter: Unused variable — joeBarAddrFixed
The report gives no description here.
LowcallBytes of _callOnAdapter unnecessarily contains costETHFixed
The report gives no description here.
LowContract lacks an easy way for users to figure out the list of authorized addresses through explorer contract inspectionFixed
The report gives no description here.
LowdepositLpToken and withdrawLpToken can deposit into and withdraw from Masterchefs other than Trader JoeFixed
The report gives no description here.
LowDOMAIN_SEPARATOR can be made immutableFixed
The report gives no description here.
Show 10 more
LowGas optimizationsFixed
The report gives no description here.
LowGas usage: getRegisteredAdapters might run out of gasFixed
The report gives no description here.
LowGetUserDepositPosition returns wrong valuesFixed
The report gives no description here.
LowGovernance privilege: The timelock can potentially sweep wallets through reentrancy during delegatecallsFixed
The report gives no description here.
LowJoeBar is now deprecatedFixed
The report gives no description here.
LowLack of events for initAuth, enable and disableFixed
The report gives no description here.
LowLack of events for initializeFixed
The report gives no description here.
LowLack of events for setCertified, setAdapManager, setAdvancedOption and other various common functionsFixed
The report gives no description here.
LowLack of events for setCodeHash and createAccountFixed
The report gives no description here.
LowLack of events for setPauseWhiteListFixed
The report gives no description here.
Show 10 more
LowLack of events for setPublicVerifier, setAccountVerifier and setFlashLoanWhiteListFixed
The report gives no description here.
LowNon-transferrable timelock address might be limiting if the client ever wants to move to a new governance structureFixed
The report gives no description here.
LowonFlashLoan does not validate _multiCall parameter lengthsFixed
The report gives no description here.
Lowpermit can be frontrun and cause denial of serviceFixed
The report gives no description here.
LowProxy receive() function prevents ControllerLib receive() from being calledFixed
The report gives no description here.
LowproxyAdmin can become outdatedFixed
The report gives no description here.
LowpullTokensIfNeeded might not pull in enough tokens for tokens with a fee on transferFixed
The report gives no description here.
Lowrouter can be made constantFixed
The report gives no description here.
LowSafeMath is unnecessary starting from Solidity version 0.8Fixed
The report gives no description here.
LowsetPauseWhiteList check can be simplifiedFixed
The report gives no description here.
Show 10 more
LowThe adapter does not allow users to call emergencyWithdrawFixed
The report gives no description here.
LowThe initialize function does not call the initialize function safelyFixed
The report gives no description here.
LowThe JTokenSnapshot structure and IJToken import are unusedFixed
The report gives no description here.
LowThe OperatorUpdate event lacks the approval type variableFixed
The report gives no description here.
LowThe registerAdapters function allows the addition of too many adaptersFixed
The report gives no description here.
LowtrustFactory and timeLock are privateFixed
The report gives no description here.
LowTypographical and minor errorsFixed
The report gives no description here.
LowTypographical errorFixed
The report gives no description here.
LowTypographical errorFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
Show 10 more
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowUI functions getUserProxyAdmin and getUserAccount can run out of gasFixed
The report gives no description here.
LowunregisterAdapters does not reset adaptersIndexFixed
The report gives no description here.
LowUnused event: CallForwardSignleFixed
The report gives no description here.
LowUnused event: ChangeAutomationFixed
The report gives no description here.
LowUnused import: IWAVAX.solFixed
The report gives no description here.
LowUnused import: Record and ProxyAdminFixed
The report gives no description here.
LowUnused importsFixed
The report gives no description here.
LowUnused imports, functionality and typographical errorsFixed
The report gives no description here.
Show 4 more
LowUnused inheritance: OwnableUpgradeable.solFixed
The report gives no description here.
LowUnused Ownable inheritanceFixed
The report gives no description here.
LowuserDatabase and timelock are privateFixed
The report gives no description here.
LowuserProxyAdmin may be outdated and may have a shorter length to userAccountFixed
The report gives no description here.
Contracts in scope14
| Address | Chain | Source code |
|---|---|---|
| 0xf8fe4e5db46d91cc30eae491363dc456e1daf2fd | Chain: Avalanche | Source code: Verified source |
| 0x25440d9e199974e705a07df6f2464291d0ba1e2f | Chain: Avalanche | Source code: Verified source |
| 0x15cbff12d53e7bde3f1618844caaef99b2836d2a | Chain: Avalanche | Source code: Verified source |
| 0x4792e147bce02e5ff2b1b70416811704b5625446 | Chain: Avalanche | Source code: Verified source |
| 0xd3812219eb241053f9cf2b43f9b367c0b28e03da | Chain: Avalanche | Source code: Verified source |
| 0x601954e6afb77dac21503dbdfa751fbef9ee5374 | Chain: Avalanche | Source code: Verified source |
| 0x056c41b8c2a2e7c6454842c9a62050fa1b5ffbae | Chain: Avalanche | Source code: Verified source |
| 0x123d4f3126b0f57b86d15382ec72a444bb6e77de | Chain: Avalanche | Source code: Verified source |
| 0xb7ead62ca64a98b21c1212bcc82436d7e7d797c3 | Chain: Avalanche | Source code: Verified source |
| 0xe7a5b5783bee4c91c2bdfb00ff5a34426b6b8a02 | Chain: Avalanche | Source code: Verified source |
Show the other 4 addresses
| Address | Chain | Source code |
|---|---|---|
| 0xec55e7cfebbe4f878e9dd998d3a038458ac3197d | Chain: Avalanche | Source code: Verified source |
| 0x28f83ce214462e888787c5cfd0cc08dd439c9920 | Chain: Avalanche | Source code: Verified source |
| 0xda7fbbdff6225e37d349676f7b65684e96dd5c16 | Chain: Avalanche | Source code: Verified source |
| 0x83b15ab252482e8afb0e47460b46aae5f145ec17 | Chain: Avalanche | Source code: Verified source |
Part of CIAN Protocol’s security record
CIAN ProtocolSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us