Audit Report
Paladin reviewed Trader Joe (Audit Report) on 9 Feb 2022: 24 findings, 0 critical; 21 marked fixed, 3 acknowledged.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings24
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 2 | 20 |
HighAn exploiter can prevent the liquidity addition step from ever happening by pre-initializing the pair with WAVAXFixed
The report gives no description here.
LowBest practice: _beforeTokenTransfer does not call the parent _beforeTokenTransferFixed
The report gives no description here.
LowBest practice: deposit does not adhere to checks-effects- interactionsFixed
The report gives no description here.
LowBest practice: Doing the user transfer before the fee transfer on withdrawals increases the exploit risk in case the contract is modifiedFixed
The report gives no description here.
LowCheck within updatePool that validates that nobody has staked yet can be circumvented by transferring a nominal JOE token to the contract leading to lost rewardsFixed
The report gives no description here.
LowContract uses manipulatable contract token balance to figure out the total number of JOE stakedFixed
The report gives no description here.
LoweventImplementation and wavax can be made immutableFixed
The report gives no description here.
LoweventImplementation cannot be changedFixed
The report gives no description here.
LowgetPenalty reverts ambiguously if the launch has not started yetFixed
The report gives no description here.
LowLack of event for withdrawIncentivesFixed
The report gives no description here.
Show 10 more
LowLack of events for setPhaseDuration and setPhaseOneNoFeeDurationFixed
The report gives no description here.
LowLack of validationFixed
The report gives no description here.
LowLack of validationFixed
The report gives no description here.
LowLack of validation on updateEmissionRate could cause excessive mintingFixed
The report gives no description here.
LowLaunchEvent is a proxy but does not use upgradeable OpenZeppelin dependenciesFixed
The report gives no description here.
LowsafeTransferFrom should be usedFixed
The report gives no description here.
LowSetting rJoe back to a previous rJoe token will be impossible since it is already initializedFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
Show 1 more
LowwithdrawAVAX can be made externalFixed
The report gives no description here.
Contracts in scope4
| Address | Chain | Source code |
|---|---|---|
| 0x5483ce08659fabf0277f9314868cc4f78687bd08 | Chain: Avalanche | Source code: Verified source |
| 0x3e6456b99ba6964f40b4f1c458a932feb5677001 | Chain: Avalanche | Source code: Verified source |
| 0x8e8c6bd1ce1a77885325aa69f3736ed41d66532e | Chain: Avalanche | Source code: Verified source |
| 0x00553fca0428eda1eb499337052636c229bebf9a | Chain: Avalanche | Source code: Verified source |
Part of Trader Joe’s security record
Trader JoeSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us