Gacha security review

Pashov Audit Group29 Jan 2025Code version: not recorded (see the report)

Audit · firm’s term: security review

Pashov Audit Group reviewed GachaAI (Gacha security review) on 29 Jan 2025: 11 findings, 1 critical; 8 marked fixed, 3 acknowledged.

1 critical finding, fixed

Open the report Open GachaAI’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	1
High	0	0	1
Medium	0	0	1
Low	0	3	5

CriticalIncorrect reserve order in _swap()Fixed

The report gives no description here.

High_swap() is vulnerable to sandwich attacksFixed

The report gives no description here.

MediumImproper handling of ERC20 transfer return valueFixed

The report gives no description here.

Lowdeadline in swapExactTokensForTokens() does not workFixed

The report gives no description here.

LowMissing referralClaimThreshold validationFixed

The report gives no description here.

LowThe excess fee has not been returned to the userFixed

The report gives no description here.

LowThe paymentToken should only be allowed to be set onceFixed

The report gives no description here.

LowThe redundant call to pool.oddsBPS.indexOf(ratio)Fixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of GachaAI’s security record

GachaAI

Audits1 audit by 1 firmLast audit Jan 2025, by Pashov Audit Group.

Critical findingsNo open critical findingsIn that report, 1 critical finding was reported. It is marked fixed by the firm that reported it.

Open GachaAI’s security record

Security firm

Pashov Audit Group

86 projects reviewed · 165 reports · latest Aug 2026

See Pashov Audit Group’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.