Lulo
Audit · firm’s term: security assessment
Certora reviewed Lulo on 10 Feb 2025: 19 findings, 7 critical; all marked fixed.
Findings28
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 7 |
| High | 0 | 0 | 4 |
| Medium | 0 | 0 | 8 |
| Low | 0 | 0 | 0 |
CriticalAnchor account state overwrite issue allows attackers to arbitrageFixed
The report gives no description here.
CriticalAttacker can make themselves the referrer of existing user accountsFixed
The report gives no description here.
CriticalAttackers can arbitrage using the withdraw_all featureFixed
The report gives no description here.
CriticalIncorrect computation of referral fee share reduces fees earned by protocolFixed
The report gives no description here.
CriticalMissing call to Pool::error_if_stale_refresh function inFixed
The report gives no description here.
CriticalReferrers can claim assets by claiming fees from a different allocationFixed
The report gives no description here.
CriticalThe complete_regular_withdraw instruction does not update oracles butFixed
The report gives no description here.
HighAllocation::update_referrer_on_withdraw function updatesFixed
The report gives no description here.
HighIncorrect implementation of oracle update staleness checkFixed
The report gives no description here.
HighIncorrect order of operations leads to incorrect total_referred_amount andFixed
The report gives no description here.
Show 9 more
HighThe withdraw_protocol function might fail when protocol weight is zeroFixed
The report gives no description here.
MediumAttacker can grief refresh_tvl operation by causingFixed
The report gives no description here.
MediumKaminoPoolWithdraw::cpi_withdraw incorrectly passes pool input tokenFixed
The report gives no description here.
MediumMissing bounds for fee parametersFixed
The report gives no description here.
MediumOracle updates fail because of incorrect assignment leading to DoSFixed
The report gives no description here.
MediumProtocol weight might become more than the max exposureFixed
The report gives no description here.
MediumSmaller refresh_stale_max_seconds can DoS the protocolFixed
The report gives no description here.
MediumThe check_protocol_weights might prevent admin from setting protocolFixed
The report gives no description here.
MediumThe pool_refresh_kamino_alt instruction lacks security checkFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lulo’s security record
LuloSecurity firm
Certora29 projects reviewed · 56 reports · latest Aug 2026
See Certora’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us