Derive security review

Sigma Prime1 Jan 2025Code version: not recorded (see the report)

Audit · firm’s term: security review

Sigma Prime reviewed Derive (Derive security review) on 1 Jan 2025: 9 findings, 1 critical; 3 marked fixed, 6 acknowledged.

1 critical acknowledged, not fixed

Open the report Open Derive’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings9

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	1	0
High	0	0	1
Medium	0	1	1
Low	0	4	1

CriticalBids Can Be Blocked By Depositing Tokens To LiquidatorAcknowledged

The report gives no description here.

MediumPrecision Loss in CashAsset.withdraw()Acknowledged

The report gives no description here.

LowAuction Bids Will Work On Both Types Of AuctionAcknowledged

The report gives no description here.

LowInsolvent Auction Bids Can Lose Bidding IncentiveAcknowledged

The report gives no description here.

LowInsolvent Auction Bids Lack Complete priceLimit ControlAcknowledged

The report gives no description here.

LowWithdrawals Temporarily Blocked By Incorrect AccountingAcknowledged

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Derive’s security record

Derive

Audits6 audits by 2 firmsLast audit Mar 2025, by Sigma Prime.

Critical findings1 critical acknowledged, not fixedReported in “Derive security review” by Sigma Prime, Jan 2025. The team acknowledged it.

Open Derive’s security record

Security firm

Sigma Prime

16 projects reviewed · 37 reports · latest Aug 2026

See Sigma Prime’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.