Velocimeter audit
Audit competition · firm’s term: public contest
Sherlock reviewed Velocimeter (Velocimeter audit) on 25 Jul 2024: 18 findings, 0 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings18
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 9 |
| Medium | 0 | 0 | 9 |
| Low | 0 | 0 | 0 |
HighDepositWithLock done via OptionToken can be abused to permanently lock a user positionFixed
The report gives no description here.
HighExercising a large amount of options gives significantly higher discounts than supposed to.Fixed
The report gives no description here.
HighIf user merges their veNFT, they'll lose part of their rewardsFixed
The report gives no description here.
HighOptionTokenV4.exerciseLP's addLiquidity lack of slippage can be abused to make victims exercise for a lower liquidity than intendedFixed
The report gives no description here.
Highpause or kill gauge can lead to FLOW token stuck in voterFixed
The report gives no description here.
Highpoke() may be dosFixed
The report gives no description here.
Highve_supply is updated incorrectlyFixed
The report gives no description here.
Highvoters cannot disable max lockFixed
The report gives no description here.
HighVotingEscrow MAX_DELEGATES value can lead to DOS on certain EVM-compatible chainsFixed
The report gives no description here.
MediumFirst liquidity provider of a newly created stable pair can cause DOS and loss of fundsFixed
The report gives no description here.
Show 8 more
MediumIncorrect calculation of TWAP in OptionTokenV4.getTimeWeightedAveragePrice() function.Fixed
The report gives no description here.
MediumRewards supplied to a gauge, prior to its first depositor will be permanently lost.Fixed
The report gives no description here.
Mediumswap may be reverted if the input amount is not large enough, especially for low decimal tokensFixed
The report gives no description here.
MediumThe circulating_supply() of the Minter contract may revert, resulting in the inability of the Minter to periodically emit Flow tokensFixed
The report gives no description here.
Mediumupdate_period(..) leads to wrong calculation in weekly emissions breaking accounting for the protocolFixed
The report gives no description here.
MediumUser can make their veNFT unpokeable by voting for a to-be-killed gaugeFixed
The report gives no description here.
MediumVoter.replaceFactory() and Voter.addFactory() functions are broken.Fixed
The report gives no description here.
MediumVoting power does not decay when calculating shares of flow emissions if the user does not vote again.Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Velocimeter’s security record
VelocimeterSecurity firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us