Spectral Special Staking audit
ABDK Consulting reviewed Spectral (Spectral Special Staking audit) on 28 Apr 2025: 33 findings, 2 critical; all marked fixed.
Report hosted on GitHub.
Statuses are the security firm’s own, from this report. Trustblock does not review code.
Findings33
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 2 |
| Medium | 0 | 0 | 6 |
| Low | 0 | 0 | 23 |
CriticalIn case a user had no stake during the distribution period, but staked some token in the very second when next distribution was created (but before it was created), then this condiFixed
The report gives no description here.
CriticalIn case all stakes for the distribution were made exactly at the end of distribution period, or in case the distribution period length is zero, this check will fail.Fixed
The report gives no description here.
HighThe returned value is ignored.Fixed
The report gives no description here.
HighTransferring two different tokens in the same transaction is a bad practice, as if there are some problems with one of the tokens, the user won’t get the other tokens as well.Fixed
The report gives no description here.
MediumConsider a situation when a user had some stakes in the past, but then withdrawn all staked tokens and didn’t have any tokens for a long period of time.Fixed
The report gives no description here.
MediumHere both, the numerator and the denominator are multiplied by the same value, which doesn’t have sense.Fixed
The report gives no description here.
MediumIn case “rewardTokenB” is zero, the “totalRewardsB” value is silently ignored, which could hide problems.Fixed
The report gives no description here.
MediumOverflow is possible when converting types.Fixed
The report gives no description here.
MediumThe “_claim” function performs several checks that doesn’t make sense to be performed on every loop iteration.Fixed
The report gives no description here.
MediumThis check may fail only when the protocol is in inconsistent state due to some coding errors and cannot proceed with distributions.Fixed
The report gives no description here.
Show 10 more
LowBad datatype in SpectralStaking.solFixed
The report gives no description here.
LowBad datatype in SpectralStaking.solFixed
The report gives no description here.
LowBad datatype in SpectralStaking.solFixed
The report gives no description here.
LowBad datatype in SpectralStaking.solFixed
The report gives no description here.
LowBad datatype in SpectralStaking.solFixed
The report gives no description here.
LowBad datatype in SpectralStaking.solFixed
The report gives no description here.
LowIt seems redundant to have both, the “claimed” field in the “UserDistribution- Info” structure and the “lastClaimedIndex” mapping, as one can be derived from the other.Fixed
The report gives no description here.
LowNo access level specified for this variable, so internal access will be used by default.Fixed
The report gives no description here.
LowProcedural in SpectralStaking.solFixed
The report gives no description here.
LowProcedural in SpectralStaking.solFixed
The report gives no description here.
Show 10 more
LowProcedural in SpectralStaking.solFixed
The report gives no description here.
LowSuboptimal in SpectralStaking.solFixed
The report gives no description here.
LowSuboptimal in SpectralStaking.solFixed
The report gives no description here.
LowThe storage addresses of fields are calculated twice here.Fixed
The report gives no description here.
LowThese assignments have no effect.Fixed
The report gives no description here.
LowThis check is redundant, as it is anyway possible to pass a dead admin address.Fixed
The report gives no description here.
LowThis check is redundant, as it is anyway possible to pass a dead reward token address.Fixed
The report gives no description here.
LowThis check is redundant, as it is anyway possible to pass a dead spectral token address.Fixed
The report gives no description here.
LowThis check is redundant, as it will anyway be performed again when burning staking tokens below.Fixed
The report gives no description here.
LowThis event is emitted even if nothing actually changed.Fixed
The report gives no description here.
Show 3 more
LowThis function should emit some event.Fixed
The report gives no description here.
LowThis should emit the “UpdateAdmin” event.Fixed
The report gives no description here.
LowWe didn’t review these files.Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Spectral’s security record
SpectralSecurity firm
ABDK Consulting31 projects reviewed · 64 reports · latest Jan 2026
See ABDK Consulting’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us