Zodial
Ackee Blockchain Security reviewed Zodial on 22 Jul 2026: 47 findings, 0 critical; 33 marked fixed, 8 acknowledged, 6 open.
Report hosted on GitHub.
Trustblock does not review code.
Findings47
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 2 |
| Medium | 2 | 1 | 12 |
| Low | 3 | 7 | 19 |
HighLP witness cache and staging paths are permissionless, enabling cache lock, eviction griefing, and attacker-shaped entriesFixed
The report gives no description here.
HighReceivership liquidation bypass via dangling LiquidationRecord linkageFixed
The report gives no description here.
Mediumignore_healthy closeout path skips the premium cap bounding seized collateral by repaid * max_feeFixed
The report gives no description here.
Mediumkeeper_close_order / close_order rent refund goes to a caller-chosen recipientFixed
The report gives no description here.
Mediumlending_pool_accrue_bank_interest is not gated by the protocol pauseFixed
The report gives no description here.
Mediummigrate_curve is permissionless, skips accrue, and skips post-construction validationFixed
The report gives no description here.
MediumOperation-type enforcement checks use tolerance without clampingFixed
The report gives no description here.
MediumPairwise liq_bonus_bps = 10000 lets lending_account_liquidate produce a zero-repayment seizureFixed
The report gives no description here.
MediumPermissionless propagation can override manual staked bank configurationFixed
The report gives no description here.
MediumRate-limiter u64 → i64 narrowing is exploitable at configuration and consumption sitesFixed
The report gives no description here.
Show 10 more
MediumStaked-with-Pyth-push oracle reads raw SVSP fields incompatible with upstream onramp upgradeFixed
The report gives no description here.
MediumStale orders can execute against unrelated positions because tags are reusableFixed
The report gives no description here.
MediumToken-2022 transfer-fee mints: outbound vault transfers underpay destinations and inbound integration deposits overcredit depositorsFixed
The report gives no description here.
Mediumtransfer_to_new_account state migration is incompleteFixed
The report gives no description here.
LowAdmin and delegate mutators bypass protocol pauseFixed
The report gives no description here.
Lowclose_balance does not update bank total shares or position countsFixed
The report gives no description here.
Lowclose_bank does not verify outstanding-fee counters and can strand collected feesFixed
The report gives no description here.
LowConfiguring rate limits resets limiter windows, allowing history erasure via no-op updatesFixed
The report gives no description here.
Lowdeposit_up_to_limit uses pre-accrual capacity, then can fail post-accrualFixed
The report gives no description here.
LowFrozen account authorities can still close orders and clear keeper-close tagsFixed
The report gives no description here.
Show 10 more
Lowkeeper_close_order can be bricked by reusing the closed marginfi_account addressFixed
The report gives no description here.
Lowlending_account_clear_emissions is permissionlessFixed
The report gives no description here.
Lowlending_account_close_balance does not check session flagsFixed
The report gives no description here.
Lowlending_pool_update_fees_destinat ion_account does not validate the destination owner or usabilityFixed
The report gives no description here.
LowLP witness staging entries are not bound to the oracle slot they were solved againstFixed
The report gives no description here.
Lowmarginfi_account_update_emissions _destination_account does not validate destinationFixed
The report gives no description here.
LowNo bounds validation on global fee parametersFixed
The report gives no description here.
LowPairwise registry accepts dangerous LTV and liquidation- bonus valuesFixed
The report gives no description here.
Lowpairwise_row_version uses unix_timestamp and cannot distinguish two updates within the same secondFixed
The report gives no description here.
Lowpulse_bank_price_cache is not gated by the protocol pauseFixed
The report gives no description here.
Show 3 more
Lowset_fixed_oracle_price accepts arbitrarily large prices and bypasses oracle stalenessFixed
The report gives no description here.
Lowshould_skip_rate_limit does not skip order execution flowsFixed
The report gives no description here.
LowTokenless-deleveraging banks still contribute full Initial- margin collateralFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Zodial’s security record
ZodialSecurity firm
Ackee Blockchain Security39 projects reviewed · 81 reports · latest Jul 2026
See Ackee Blockchain Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us