Clober Protocol Security Review

Cairo Security ClanFiles named in the report

Audit · firm’s term: security review

Cairo Security Clan reviewed Clober Protocol (Clober Protocol Security Review) on 19 Nov 2024: 9 findings, 2 critical; all marked fixed.

2 critical findings, fixed
Open the reportOpen Clober Protocol’s security record
Report stored on IPFS. Content hash bafybeiahxr5tgk3rafrj7jzczxnyv4gmq4zoejlhznvnomo4erynugtpo4

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical002
High000
Medium002
Low005
CriticalAttacker could cancel any order and steal the pending quoteFixed

The controller contract allows anyone to call cancel for any order without needing approval from the NFT owner, enabling an attacker to cancel any order and steal the pending quote.

CriticalAttacker could claim any order and steal the claimable baseFixed

The controller contract allows anyone to call claim for any order without needing approval from the NFT owner, enabling an attacker to claim and steal the claimable base token.

MediumFlawed check in function is_valid_hook_address permits hook without any flags setFixed

The report gives no description here.

Mediumis_base_remained not set when limit_price reached in function _spendFixed

The report gives no description here.

LowBreaking condition in the while loop in function query might cause a revert due to overflowFixed

The report gives no description here.

LowConfusing parameter name in function reserves_ofFixed

The report gives no description here.

LowFunction lock_data might return incorrect length due to operator precedenceFixed

The report gives no description here.

LowOrder id packing can overflow felt252 limitFixed

The report gives no description here.

LowUnchecked return values of ERC20 transferFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (16)

  • src/libraries/book_key.cairo
  • src/libraries/book.cairo
  • src/libraries/segmented_segment_tree.cairo
  • src/libraries/lockers.cairo
  • src/libraries/tick.cairo
  • src/libraries/fee_policy.cairo
  • src/libraries/hooks.cairo
  • src/libraries/storage_map.cairo
  • src/book_manager.cairo
  • src/utils/packed_felt252.cairo
  • src/utils/math.cairo
  • src/libraries/tick_bitmap.cairo
  • src/libraries/order_id.cairo
  • src/libraries/total_claimable_map.cairo
  • src/libraries/hooks_list.cairo
  • src/controller.cairo

Part of Clober Protocol’s security record

Clober Protocol
Audits1 audit by 1 firmLast audit Nov 2024, by Cairo Security Clan.
Critical findingsNo open critical findingsIn that report, 2 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Clober Protocol’s security record

Security firm

Cairo Security Clan

13 projects reviewed · 21 reports · latest Sep 2025

See Cairo Security Clan’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us