Fodl
Quantstamp reviewed Fodl Finance (Fodl) on 13 Oct 2021: 11 findings, 0 critical; 4 marked fixed, 5 acknowledged, 2 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings11
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 2 | 5 | 4 |
LowAllowance Double-Spend ExploitOpen
As it presently is constructed, the contract is vulnerable to the [allowance double-spend exploit](https://github.com/OpenZeppelin/openzeppelin-solidity/blob/b4f87bb8fc25fb07f73099701e39e167a3d36465/contracts/token/ERC20/ERC20.sol#L71-L78), as with other ERC20 tokens.
LowUnchecked function argumentsOpen
1. `FoldingRegistry.initialize()` does not check that each address argument is non-zero. **Update: ** fixed. 1. `FoldingRegistry. addImplementation()` does not check that each address argument is non-zero. **Update: ** fixed. 1. `FoldingRegistry. addPlatformWithAdapter()` does not check that each address argument is non-zero. **Update: ** fixed. 1. `FoldingRegistry. changePlatformAdapter()` does not check that each address argument is non-zero. **Update: ** fixed. 1. `FoldingRegistry. addCTokenOnPlatform()` does not check that each address argument is non-zero. **Update: ** fixed. 1. `FoldingRegistry. addExchangerWithAdapter()` does not check that each address argument is non-zero. **Update: ** fixed. 1. `FoldingRegistry. changeExchangerAdapter()` does not check that each address argument is non-zero. **Update: ** fixed. 1. `FoldingAccount.constructor()` does not check that each address argument is non-zero. **Update: ** acknowledged. 1. `FundsManager.constructor()` does not check that each address argument is non-zero. It also does not check that `_profit` and `_principle` are both `<= MANTISSA`. **Update: ** fixed. 1. `DecreaseWithV3FlashswapMultihopConnector.constructor()` does not check that each address argument is non-zero. 1. `IncreaseWithV3FlashswapMultihopConnector.constructor()` does not check that each address argument is non-zero. 1. `LeverageWithV3FlashswapConnector.constructor()` does not check that each address argument is non-zero. 1. `RewardsDistributor.constructor()` does not check that each address argument is non-zero.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (71)
- contracts/Fodl/modules/FlashLoaner/DyDx/ICallee.sol
- contracts/Fodl/connectors/SimplePosition/SimplePositionStopLossConnector.sol
- contracts/Fodl/mocks/AavePriceOracleMock.sol
- contracts/Libs/IUSDT.sol
- contracts/Fodl/modules/Exchanger/UniswapExchangerAdapter.sol
- contracts/Fodl/modules/StopLoss/StopLossStorage.sol
- contracts/Fodl/connectors/SimplePosition/DecreaseWithV3FlashswapMultihopConnector.sol
- contracts/Fodl/modules/Exchanger/SushiswapExchangerAdapter.sol
- contracts/Libs/IWBTC.sol
- contracts/Fodl/connectors/ResetAccountConnector.sol
- contracts/Fodl/connectors/AllConnectors.sol
- contracts/Fodl/connectors/SimplePosition/LeverageWithV3FlashswapConnector.sol
- contracts/Fodl/core/interfaces/IFoldingConnectorProvider.sol
- contracts/Fodl/modules/Lender/ILendingPlatform.sol
- contracts/Fodl/modules/Lender/Compound/ICEther.sol
- contracts/Fodl/modules/Exchanger/ControlledExchangerAdapter.sol
- contracts/Fodl/connectors/interfaces/ISimplePositionLendingConnector.sol
- contracts/Fodl/core/FodlNFT.sol
- contracts/Fodl/connectors/interfaces/IIncreaseWithV3FlashswapMultihopConnector.sol
- contracts/Fodl/modules/Exchanger/ExchangerDispatcher.sol
- contracts/FodlToken/FodlToken.sol
- contracts/Fodl/modules/FlashLoaner/DyDx/DydxFlashloanBase.sol
- contracts/Fodl/core/FoldingRegistry.sol
- contracts/Fodl/core/interfaces/IFoldingAccountOwnerProvider.sol
- contracts/Fodl/connectors/interfaces/IClaimRewardsConnector.sol
- contracts/Fodl/modules/FoldingAccount/FoldingAccountStorage.sol
- contracts/Fodl/modules/Flashswapper/FlashswapStorage.sol
- contracts/Fodl/modules/SimplePosition/SimplePositionStorage.sol
- contracts/Fodl/lens/LendingPlatformLens.sol
- contracts/Libs/IWETH.sol
- contracts/Fodl/connectors/SimplePosition/IncreaseWithV3FlashswapMultihopConnector.sol
- contracts/Fodl/lens/SimplePositionLens.sol
- contracts/Libs/Uint2Str.sol
- contracts/Libs/IDAI.sol
- contracts/Fodl/modules/FundsManager/FundsManager.sol
- contracts/Fodl/connectors/interfaces/IResetAccountConnector.sol
- contracts/Fodl/modules/Lender/Aave/Interfaces.sol
- contracts/Fodl/connectors/interfaces/ISimplePositionLeveragedLendingConnector.sol
- contracts/Fodl/modules/Lender/LendingDispatcher.sol
- contracts/Fodl/modules/Lender/Compound/ICompoundPriceOracle.sol
- contracts/Fodl/modules/Lender/Compound/ICToken.sol
- contracts/Fodl/modules/Lender/Aave/AaveLendingAdapter.sol
- contracts/Fodl/connectors/SimplePosition/SimplePositionLeveragedLendingConnector.sol
- contracts/Fodl/core/interfaces/IExchangerAdapterProvider.sol
- contracts/Fodl/core/interfaces/ICTokenProvider.sol
- contracts/Fodl/mocks/FoldingRegistryUpgradedMock.sol
- contracts/Fodl/mocks/CompoundPriceOracleMock.sol
- contracts/Fodl/connectors/SimplePosition/SimplePositionBaseConnector.sol
- contracts/Fodl/modules/Lender/Compound/IComptroller.sol
- contracts/Libs/IUSDC.sol
- contracts/Libs/IDOLA.sol
- contracts/Fodl/core/interfaces/ILendingPlatformAdapterProvider.sol
- contracts/Fodl/modules/FlashLoaner/DyDx/DyDxFlashModule.sol
- contracts/Libs/Mathemagic.sol
- contracts/Fodl/modules/FlashLoaner/DyDx/ISoloMargin.sol
- contracts/Fodl/mocks/ExchangerMock.sol
- contracts/Fodl/connectors/interfaces/ILeverageWithV3FlashswapConnector.sol
- contracts/Fodl/connectors/SimplePosition/ClaimRewardsConnector.sol
- contracts/Fodl/modules/Lender/Compound/CompoundForksLendingAdapter.sol
- contracts/Fodl/connectors/interfaces/ISimplePositionBaseConnector.sol
- contracts/Fodl/modules/Exchanger/TestExposedExchangerDispatcher.sol
- contracts/Fodl/connectors/interfaces/ISimplePositionStopLossConnector.sol
- contracts/Libs/ForceSend.sol
- contracts/Fodl/core/FoldingAccount.sol
- contracts/Fodl/connectors/SimplePosition/SimplePositionLendingConnector.sol
- contracts/Fodl/modules/Exchanger/IExchanger.sol
- contracts/Fodl/mocks/ERC20Mock.sol
- contracts/Fodl/modules/Exchanger/IUniswap.sol
- contracts/Fodl/connectors/interfaces/IDecreaseWithV3FlashswapMultihopConnector.sol
- contracts/Fodl/modules/Exchanger/ControlledExchanger.sol
- contracts/FodlRewards/RewardsDistributor.sol
Part of Fodl Finance’s security record
Security firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us