StakeDAO security review
Audit · firm’s term: security review
Pashov Audit Group reviewed Stake DAO (StakeDAO security review) on 24 Jul 2025: 21 findings, 2 critical; 14 marked fixed, 7 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 1 |
| High | 0 | 0 | 0 |
| Medium | 0 | 2 | 6 |
| Low | 0 | 4 | 7 |
CriticalMissing update of extra reward per token during depositFixed
The report gives no description here.
MediumDeploy functions is vulnerable to DoS attack vectorsFixed
The report gives no description here.
MediumIERC20Metadata interface is not compatible with USDTFixed
The report gives no description here.
MediumInitial position's liquidity so close to liquidationFixed
The report gives no description here.
MediumMarket creation fails due to wrong pool address in oracle deploymentFixed
The report gives no description here.
MediumStrategyWrapper.depositAssets() reverts due to missing approvalFixed
The report gives no description here.
MediumUnclaimed rewards are lost if user deposits before claiming rewardsFixed
The report gives no description here.
LowCurveLendingMarketFactory contract size exceeds mainnet limitFixed
The report gives no description here.
LowCurveStableswapOracle.price() can overestimate the price of the collateral tokenFixed
The report gives no description here.
LowgetConversionPath() does not handle the zero address feedFixed
The report gives no description here.
Show 4 more
LowLack of protocol ID check in Curve lending market deploymentFixed
The report gives no description here.
LowMorpho market creation might fail for some IRMsFixed
The report gives no description here.
LowMorpho market creation might require excessive fundsFixed
The report gives no description here.
Lowname() function can revert for some Curve poolsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Stake DAO’s security record
Stake DAOSecurity firm
Pashov Audit Group64 projects reviewed · 122 reports · latest Aug 2026
See Pashov Audit Group’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us