Gridex Protocol audit
ABDK Consulting reviewed Gridex (Gridex Protocol audit) on 14 Mar 2023: 154 findings, 0 critical; 38 marked fixed, 116 acknowledged.
Report hosted on GitHub.
Statuses are the security firm’s own, from this report. Trustblock does not review code.
Findings154
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 11 |
| Medium | 0 | 16 | 6 |
| Low | 0 | 99 | 21 |
HighUnderflow here is prevented implicitly by a complex business logic.Acknowledged
The report gives no description here.
MediumDifferent types are used for token amounts.Acknowledged
The report gives no description here.
MediumHere a signed type is used for a token amount, while in most of the other places unsigned types are used.Acknowledged
The report gives no description here.
MediumMultiplication after division could lead to precision degradation.Acknowledged
The report gives no description here.
MediumOver-/underflow is possible here.Acknowledged
The report gives no description here.
MediumOverflow is possible here.Acknowledged
The report gives no description here.
MediumOverflow is possible here.Acknowledged
The report gives no description here.
MediumOverflow is possible when converting to “uint128”.Acknowledged
The report gives no description here.
MediumThere are no range checked for the parameters obtained here.Acknowledged
The report gives no description here.
MediumThere is no check to ensure that makerFeePips < 0.Acknowledged
The report gives no description here.
Show 10 more
MediumThere is no range check for the “priceX96” argument.Acknowledged
The report gives no description here.
MediumThis function divides its argument by “resolution” and then multiples the returned value by “resolution”.Acknowledged
The report gives no description here.
MediumThis makes a swap to stop at a word boundary.Acknowledged
The report gives no description here.
MediumUnderflow is possible here.Acknowledged
The report gives no description here.
MediumUnderflow is possible when calculating the second parts.Acknowledged
The report gives no description here.
MediumUnderflow is possible when converting to “uint24”.Acknowledged
The report gives no description here.
MediumWriting the same grid address into two storage slots looks like waste of gas.Acknowledged
The report gives no description here.
LowBad datatype in Grid.solAcknowledged
The report gives no description here.
LowBad datatype in Grid.solAcknowledged
The report gives no description here.
LowBad datatype in Grid.solAcknowledged
The report gives no description here.
Show 10 more
LowBad datatype in Grid.solAcknowledged
The report gives no description here.
LowBad datatype in GridAddress.solAcknowledged
The report gives no description here.
LowBad datatype in GridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in GridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in GridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in GridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in GridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in GridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in GridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in GridFactory.solAcknowledged
The report gives no description here.
Show 10 more
LowBad datatype in GridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in GridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IGrid.solAcknowledged
The report gives no description here.
LowBad datatype in IGrid.solAcknowledged
The report gives no description here.
LowBad datatype in IGrid.solAcknowledged
The report gives no description here.
LowBad datatype in IGridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in IGridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in IGridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in IGridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in IGridDeployer.solAcknowledged
The report gives no description here.
Show 10 more
LowBad datatype in IGridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in IGridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in IGridDeployer.solAcknowledged
The report gives no description here.
LowBad datatype in IGridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IGridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IGridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IGridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IGridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IGridFactory.solAcknowledged
The report gives no description here.
LowBad datatype in IGridFactory.solAcknowledged
The report gives no description here.
Show 10 more
LowBad datatype in IGridParameters.solAcknowledged
The report gives no description here.
LowBad datatype in IGridParameters.solAcknowledged
The report gives no description here.
LowBad datatype in IGridStructs.solAcknowledged
The report gives no description here.
LowBad datatype in IPriceOracle.solAcknowledged
The report gives no description here.
LowBad datatype in IPriceOracle.solAcknowledged
The report gives no description here.
LowBad datatype in IPriceOracle.solAcknowledged
The report gives no description here.
LowBad datatype in PriceOracle.solAcknowledged
The report gives no description here.
LowBad datatype in PriceOracle.solAcknowledged
The report gives no description here.
LowBad datatype in PriceOracle.solAcknowledged
The report gives no description here.
LowBad datatype in PriceOracle.solAcknowledged
The report gives no description here.
Show 10 more
LowBad naming in IGridEvents.solAcknowledged
The report gives no description here.
LowBad naming in IPriceOracle.solAcknowledged
The report gives no description here.
LowBad naming in ITradingConfig.solAcknowledged
The report gives no description here.
LowDespite the name, this function returns a single grid.Acknowledged
The report gives no description here.
LowHardcoding this value is error-prone.Acknowledged
The report gives no description here.
LowIt actually cannot, as “a” has 192 bits and “b” has 96 bits at most.Acknowledged
The report gives no description here.
LowIt is unclear what overflows are meant here, as there are several places inside the block where overflow is possible.Acknowledged
The report gives no description here.
LowOverflow here is prevented implicitly by the previous assignment.Acknowledged
The report gives no description here.
LowProcedural in Grid.solAcknowledged
The report gives no description here.
LowProcedural in ITradingConfig.solAcknowledged
The report gives no description here.
Show 10 more
LowSigned word position looks weird.Acknowledged
The report gives no description here.
LowSome amounts are represented as “uint256” while other are represented as “uint128”.Acknowledged
The report gives no description here.
LowStoring a creation code in the storage costs much gas.Acknowledged
The report gives no description here.
LowSuboptimal in BitMath.solAcknowledged
The report gives no description here.
LowSuboptimal in BitMath.solAcknowledged
The report gives no description here.
LowSuboptimal in BoundaryBitmap.solAcknowledged
The report gives no description here.
LowSuboptimal in BoundaryBitmap.solAcknowledged
The report gives no description here.
LowSuboptimal in BundleMath.solAcknowledged
The report gives no description here.
LowSuboptimal in Grid.solAcknowledged
The report gives no description here.
LowSuboptimal in Grid.solAcknowledged
The report gives no description here.
Show 10 more
LowSuboptimal in Grid.solAcknowledged
The report gives no description here.
LowSuboptimal in GridDeployer.solAcknowledged
The report gives no description here.
LowSuboptimal in IGrid.solAcknowledged
The report gives no description here.
LowSuboptimal in ITradingConfig.solAcknowledged
The report gives no description here.
LowSuboptimal in PriceOracle.solAcknowledged
The report gives no description here.
LowSuboptimal in PriceOracle.solAcknowledged
The report gives no description here.
LowSuboptimal in SwapMath.solAcknowledged
The report gives no description here.
LowSuboptimal in TradingConfig.solAcknowledged
The report gives no description here.
LowSuboptimal in TradingConfig.solAcknowledged
The report gives no description here.
LowThe names are confusing.Acknowledged
The report gives no description here.
Show 10 more
LowThe semantics of the keys in these mappings is Unclear.Acknowledged
The report gives no description here.
LowThe semantics of this field is unclear.Acknowledged
The report gives no description here.
LowThe word “transfer” is confusing.Acknowledged
The report gives no description here.
LowThere are no range checks for the “resolution” arguments.Acknowledged
The report gives no description here.
LowThere is no range check for this argument.Acknowledged
The report gives no description here.
LowThese checks are redundant.Acknowledged
The report gives no description here.
LowThese functions should emit some events and these events should be declared in this interface.Acknowledged
The report gives no description here.
LowThese two constants have the same value.Acknowledged
The report gives no description here.
LowThese two constants have the same value.Acknowledged
The report gives no description here.
LowThese two constants have the same value.Acknowledged
The report gives no description here.
Show 10 more
LowThis callback uses the “int256” type for token amounts, while other Gridex callbacks use “uint256” and “uint128”.Acknowledged
The report gives no description here.
LowThis callback uses the “uint128” type for token amounts, while other Gridex callbacks use “uint256” and “int256”.Acknowledged
The report gives no description here.
LowThis callback uses the “uint256” type for token amounts, while other Gridex callbacks use “uint128” and “int256”.Acknowledged
The report gives no description here.
LowThis function doesn’t check boudary range, as it may mark out of range boundary as “valid”.Acknowledged
The report gives no description here.
LowThis function should return a single value of type “FeeConfig”.Acknowledged
The report gives no description here.
LowThis function should return a single value of type “Parameters”.Acknowledged
The report gives no description here.
LowThis interface seems to contain an arbitrary subset of the “IWETH9” interface.Acknowledged
The report gives no description here.
LowThis looks like an attempt to fix a bug in the calling code.Acknowledged
The report gives no description here.
LowThis version requirement is inconsistent with version requirements in other files.Acknowledged
The report gives no description here.
LowThis version requirement is inconsistent with version requirements in other files.Acknowledged
The report gives no description here.
Show 6 more
LowThis version requirement is inconsistent with version requirements in other files.Acknowledged
The report gives no description here.
LowThis version requirement is inconsistent with version requirements in other files.Acknowledged
The report gives no description here.
LowUnderflow is prevented here via a complicated business logic.Acknowledged
The report gives no description here.
LowWord “grid” in the interface name but “gridex” in the function name.Acknowledged
The report gives no description here.
LowWord “grid” in the interface name but “gridex” in the function name.Acknowledged
The report gives no description here.
LowWord “grid” in the interface name but “gridex” in the function name.Acknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Gridex’s security record
Security firm
ABDK Consulting31 projects reviewed · 64 reports · latest Jan 2026
See ABDK Consulting’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us