MakerDAO Liquidations 2.0

QuantstampFiles named in the report

Quantstamp reviewed Sky (MakerDAO Liquidations 2.0) on 25 Feb 2021: 12 findings, 0 critical; 2 marked fixed, 9 acknowledged, 1 open.

No open critical findings
Open the reportOpen Sky’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings12

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium110
Low082
LowAuction may halt if peek is zeroFixed

There is no check that enforces the price returned by `pip.peek()` be greater than zero inside `Clipper.kick` and `Clipper.redo`. This would lead to setting the `top` value of an auction to zero, which is probably not desired. Having `top == 0` would cause a revert in the `rdiv(price, top)` inside the `Clipper.status` function, which would block access to calling `Clipper.redo` and `Clipper.take` again for `tail` amount of seconds.

LowDivision by zeroFixed

There is a primitive division operation inside the `bark` function which could lead to a “division by zero” error, because the divisor is not checked to be greater than zero, i.e. the 2nd division on L174: `dart = min(art, mul(room, WAD) / rate / milk.chop);` where `milk.chop` could be zero if set by the `Dog.file` function.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (3)

  • src/clip.sol
  • src/dog.sol
  • src/abaci.sol

Part of Sky’s security record

Sky
Audits150 audits by 3 firmsLast audit Nov 2026, by ChainSecurity.
Critical findingsNo open critical findingsAcross the 150 reports, 2 critical findings were reported. Each is marked fixed by the firm that reported it.
Open Sky’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us