Exactly Protocol Update - Staking Contract audit
Audit competition · firm’s term: public contest
Sherlock reviewed Exactly Protocol (Exactly Protocol Update - Staking Contract audit) on 25 Jul 2024: 13 findings, 0 critical; 10 marked fixed, 3 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings13
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 3 | 10 |
| Low | 0 | 0 | 0 |
MediumAnyone will DoS setting a new rewards duration which harms the protocol/users as they will receive too much or too little rewardsFixed
The report gives no description here.
MediumAttackers will reset avgStart of any user making rewards stuck for longer and get lost to savingsFixed
The report gives no description here.
MediumDepositing to another receiver othan than msg.sender will lead to stuck funds by increasing avgStart without claimingFixed
The report gives no description here.
MediumFrozen/paused Market that is harvested from in StakedEXA will DoS deposits leading to loss of yieldFixed
The report gives no description here.
MediumHaving no deposits in StakedEXA will lead to stuck rewards when harvestingFixed
The report gives no description here.
MediumLiquidator will leave a pool with unassigned earnings on Market::clearBadDebt() free to claim for anyone when the repaid maturity is not the lastFixed
The report gives no description here.
MediumMarket utilization ratio near 100% will DoS deposits as harvest tries to withdraw and revertsFixed
The report gives no description here.
MediumPrecision Loss in notifyRewardAmount Function Causes Unclaimable RewardTokenFixed
The report gives no description here.
MediumRewards Can Be Harvested Even When Distribution Is Marked As FinishedFixed
The report gives no description here.
MediumSetting a new market will make depositing to the market impossible when harvesting, DoSing depositsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Exactly Protocol’s security record
Exactly ProtocolSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us