Audit Report: Kalao Builder
Paladin reviewed Kalao (Audit Report: Kalao Builder) on 5 Apr 2022: 39 findings, 0 critical; 8 marked fixed, 31 acknowledged.
Report hosted on paladinsec.co.
Trustblock does not review code.
Findings39
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 5 | 0 |
| Medium | 0 | 3 | 0 |
| Low | 0 | 23 | 8 |
HighGovernance privilege: gov can withdraw all tokens through withdrawTokenAcknowledged
The report gives no description here.
HighGovernance privilege: handler addresses are able to make crucial changes to the protocol and the user through handler-specific functionsAcknowledged
The report gives no description here.
HighGovernance privilege: Handler addresses may stake, unstake and claim on behalf of userAcknowledged
The report gives no description here.
HighGovernance privilege: Handler can transfer unlimited amount through transferFromAcknowledged
The report gives no description here.
HighGovernance privilege: Owner can withdraw all tokens through withdrawTokenAcknowledged
The report gives no description here.
MediumGovernance privilege: transfer, stake, and claim can be disabled by Gov through setInPrivateTransferMode, setInPrivateStakingMode and setInPrivateClaimingModeAcknowledged
The report gives no description here.
MediumtransferStakeValues can be used multiple times to inflate the values of transferredAverageStakedAmounts, transferredCumulativeRewards, andAcknowledged
The report gives no description here.
MediumWhen the admin changes the emission rate from zero to non-zero, rewards will be given retroactively over the whole period where no rewards were supposed to be givenAcknowledged
The report gives no description here.
Low_deposit does not support fee-on-transfer tokensAcknowledged
The report gives no description here.
Lowclaim can be used to redirect rewards to another addressAcknowledged
The report gives no description here.
Show 10 more
LowConstructor lacks a zero address check in the rewardToken and rewardTracker inputAcknowledged
The report gives no description here.
LowConstructor lacks a zero address check in the token address inputsAcknowledged
The report gives no description here.
LowdepositForAccount forces a transfer from an _account into the vesting contract and not a helper function where governance can deposit tokens on behalf of a userAcknowledged
The report gives no description here.
LowgetTotalVested computation is inconsistent as cumulativeClaimAmounts is going to reset whenever a call to withdraw() is madeAcknowledged
The report gives no description here.
LowGovernance privilege: Owner can withdraw all tokens including the reward tokens through withdrawTokenAcknowledged
The report gives no description here.
LowGovernance privilege: Owner can withdraw all tokens through withdrawTokenAcknowledged
The report gives no description here.
LowLack of events for setAdmin, withdrawToken and updateLastDistributionTimeAcknowledged
The report gives no description here.
LowLack of events for setGovAcknowledged
The report gives no description here.
LowLack of events for several functionsAcknowledged
The report gives no description here.
LowLack of events for several functionsAcknowledged
The report gives no description here.
Show 10 more
LowLack of indexing for event parametersAcknowledged
The report gives no description here.
LowLack of indexing for event parametersAcknowledged
The report gives no description here.
LowLack of indexing for event parameters for Claim, Deposit and WithdrawAcknowledged
The report gives no description here.
LowLack of validation: gov can be set to the zero addressAcknowledged
The report gives no description here.
LowsetTokensPerInterval function lacks a maximum value check where excessive rewards may be distributedAcknowledged
The report gives no description here.
LowTypographical errorsAcknowledged
The report gives no description here.
LowTypographical errorsAcknowledged
The report gives no description here.
LowTypographical errorsAcknowledged
The report gives no description here.
LowTypographical errorsAcknowledged
The report gives no description here.
LowVesting logic speeds up second deposits once the cumulativeClaimAmounts have been increased due to the previous deposit madeAcknowledged
The report gives no description here.
Show 1 more
Lowwithdraw, _deposit, _updateVesting are not written in the checks-effects-interactions patternAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Kalao’s security record
Security firm
Paladin176 projects reviewed · 241 reports · latest Apr 2025
See Paladin’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us