KittenSwap security review
Audit · firm’s term: security review
Pashov Audit Group reviewed KittenSwap (KittenSwap security review) on 22 May 2025: 55 findings, 2 critical; 36 marked fixed, 19 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings55
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 2 |
| High | 0 | 0 | 7 |
| Medium | 0 | 3 | 13 |
| Low | 0 | 16 | 14 |
CriticalCLGauge sends KITTEN rewards to itself instead of to stakersFixed
The report gives no description here.
Criticalsplit can be abused to create locked data with an arbitrary amountFixed
The report gives no description here.
HighDuplicate tokenId in delegate list may inflate votesFixed
The report gives no description here.
HighExternalBribe.earned skips rewards before the last tokenId checkpointFixed
The report gives no description here.
HighInconsistent rounding of lock time causes voting power errorsFixed
The report gives no description here.
HighIncorrect last_point.blk calculation due to shared memory in _checkpoint()Fixed
The report gives no description here.
HighIncorrect next epoch supply usage affects reward calculationFixed
The report gives no description here.
HighLack of access control in CLGauge creation allows unauthorized PoolsFixed
The report gives no description here.
HighLoss of claimable rewards upon gauge deactivationFixed
The report gives no description here.
Mediumcheckpoint.timestamp inside VotingEscrow never usedFixed
The report gives no description here.
Show 10 more
MediumDesync lets bribes be received without emissionsFixed
The report gives no description here.
MediumDOS attack by delegating tokens at MAX_DELEGATES = 1024Fixed
The report gives no description here.
MediumIncorrect check inside CLGauge.claimFeesFixed
The report gives no description here.
MediumMerging or withdrawing VotingEscrow burns tokens without rewardsFixed
The report gives no description here.
MediumMissing rescue reward function in Gauge, CLGauge, BribesFixed
The report gives no description here.
MediumPotential revert in earned() when checkpoint supply is zeroFixed
The report gives no description here.
Mediumsplit() mints NFTs to msg.sender not the original ownerFixed
The report gives no description here.
MediumUser can prevent poke() from updating voting powerFixed
The report gives no description here.
MediumVotingEscrow._burn prevents approved spender from using withdraw()Fixed
The report gives no description here.
MediumVotingEscrow.withdraw cannot be called by an approved tokenId spenderFixed
The report gives no description here.
Show 10 more
MediumWeight loss possible due to invalid pool votes in _vote()Fixed
The report gives no description here.
MediumWrong supply accounting in merge functionFixed
The report gives no description here.
LowCalling notifyRewardAmount for unsupported tokens can grief gaugeFixed
The report gives no description here.
LowCLGauge should use ERC721HolderUpgradeable instead of ERC721HolderFixed
The report gives no description here.
LowCLGauge.earned could revert due to reward growth underflowFixed
The report gives no description here.
LowGauge may receive rewards for period it was dead when revivedFixed
The report gives no description here.
LowInconsistent DOMAIN_TYPEHASHFixed
The report gives no description here.
LowInitializer pattern in ClFactory lacks upgrade, risks frontrunningFixed
The report gives no description here.
LowIrreversible whitelisting of tokensFixed
The report gives no description here.
LowLack of _disableInitializers in upgradeable contractsFixed
The report gives no description here.
Show 6 more
LowNo revert in ownerOf() for non- existent token IDsFixed
The report gives no description here.
LowPotential liquidity overflowFixed
The report gives no description here.
LowRedundant check for _votes in _reset() functionFixed
The report gives no description here.
LowReward calculation reverts due to potential arithmetic overflowFixed
The report gives no description here.
LowUsers can create NFTs with 0 locked amount through split functionFixed
The report gives no description here.
LowUsers can deposit NFTs into killed CL gaugesFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of KittenSwap’s security record
KittenSwapSecurity firm
Pashov Audit Group86 projects reviewed · 165 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us