Audit Report - Trader Joe (v2 Vaults)
Paladin reviewed Trader Joe (Audit Report - Trader Joe (v2 Vaults)) on 11 May 2023: 37 findings, 0 critical; 26 marked fixed, 11 acknowledged.
Trustblock does not review code.
Findings37
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 11 | 25 |
HighPending queues are burnable by anyoneFixed
The report gives no description here.
Low_getName can return an incorrect name in future deploymentsFixed
The report gives no description here.
LowcancelQueuedWithdrawal sends the shares to the wrong addressFixed
The report gives no description here.
LowFee for queued amounts is rounded downFixed
The report gives no description here.
LowfeeRecipient can be address(0)Fixed
The report gives no description here.
LowGeneral governance privilegesFixed
The report gives no description here.
LowIncompatibility with DEX V2.1Fixed
The report gives no description here.
LowLack of balance check after token transfer in recoverERC20 can allow draining of underlying tokens with double entry pointsFixed
The report gives no description here.
LowLack of events for recoverERC20Fixed
The report gives no description here.
LowLack of staleness check for Chainlink priceFixed
The report gives no description here.
Show 10 more
LowLack of use of safeApprove in swapFixed
The report gives no description here.
LowLack of validationFixed
The report gives no description here.
LowLack of verification that both oracle feeds have the same decimalsFixed
The report gives no description here.
LowMultiple spots are incompatible with DEX V2.1Fixed
The report gives no description here.
LowPending fee logic is unused in DEX V2.1Fixed
The report gives no description here.
LowPossible revert in executeQueuedWithdrawals due to safe downcastingFixed
The report gives no description here.
LowPossible revert in multiplication overflow in _withdrawFixed
The report gives no description here.
LowPossible revert in multiplication overflow in emergencyWithdrawFixed
The report gives no description here.
LowredeemQueuedWithdrawal and redeemQueuedWithdrawalNative allow anyone to redeem any queued withdrawalFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
Show 6 more
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical errorsFixed
The report gives no description here.
LowTypographical issuesFixed
The report gives no description here.
LowUnnecessary casting to uint24Fixed
The report gives no description here.
LowUnnecessary duplicate condition check in recoverERC20Fixed
The report gives no description here.
Contracts in scope4
| Address | Chain | Source code |
|---|---|---|
| 0xc8240c9e7ea8f94ac12da06b1b17be3e0f415a6d | Chain: Avalanche | Source code: Verified source |
| 0xaf705a05789bedcb5d4983453da7d35f4585d92c | Chain: Avalanche | Source code: Verified source |
| 0x613addd55d30bf626c3009e9dac66222346ae760 | Chain: Avalanche | Source code: Verified source |
| 0xfa92d54bad5bb85f59e73b557ea9bbd7b3b7f266 | Chain: Avalanche | Source code: Verified source |
Part of Trader Joe’s security record
Trader JoeSecurity firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us