Arcadia security review
Audit · firm’s term: security review
Nethermind Security reviewed Arcadia (Arcadia security review) on 2 Mar 2023: 16 findings, 3 critical; 15 marked fixed, 1 acknowledged; 1 more marked mitigated.
Report hosted on GitHub.
Trustblock does not review code.
Findings28
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed | Mitigated |
|---|---|---|---|---|
| Critical | 0 | 0 | 3 | 0 |
| High | 0 | 0 | 1 | 0 |
| Medium | 0 | 0 | 4 | 0 |
| Low | 0 | 1 | 7 | 1 |
CriticalUnused collateral can be stolen from vaults through the lending poolFixed
The report gives no description here.
CriticalVault’s baseCurrency may differ from the one set by the TrustedCreditorFixed
The report gives no description here.
CriticalVaults can borrow from a lending pool different from their trusted creditorFixed
The report gives no description here.
HighPrivileged vault roles not reset upon ownership changeFixed
The report gives no description here.
MediumIncorrect calculation of openDebt during Vault liquidationFixed
The report gives no description here.
MediumminPriceMultiplier is not scaled to 20 decimals in _calcPriceOfVault(...)Fixed
The report gives no description here.
MediumPricing module exposure can be manipulated for WETH tokenFixed
The report gives no description here.
MediumVault deployment susceptible to Denial of Service AttacksFixed
The report gives no description here.
LowAsset can be added with an inactive oracle or with no oraclesFixed
The report gives no description here.
LowAsset can be added with an incorrect oracle sequenceFixed
The report gives no description here.
Show 5 more
LowERC721 pricing modules exposure manipulationFixed
The report gives no description here.
LowLiquidator contract owner can manipulate live auction pricingFixed
The report gives no description here.
LowRounding issues in DebtToken shares calculation can steal funds from LendingPoolFixed
The report gives no description here.
LowVault asset limit can be bypassed with vaultManagementAction(...)Fixed
The report gives no description here.
LowVault beneficiaries indirectly obtain the asset manager roleFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Arcadia’s security record
ArcadiaSecurity firm
Nethermind Security57 projects reviewed · 81 reports · latest Sep 2026
See Nethermind Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us