Terrace Fi audit
Audit competition · firm’s term: private contest
Sherlock reviewed Terrace (Terrace Fi audit) on 1 Jun 2024: 27 findings, 0 critical; 17 marked fixed, 10 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings27
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 1 | 6 |
| Medium | 0 | 9 | 11 |
| Low | 0 | 0 | 0 |
HighERC20-only trades can be done on Maradona by setting a fake dust ETH trade at the beginning (while also bypassing fees)Fixed
The report gives no description here.
HighFees can be bypassed by 99.99% by setting the last hop's ratioBps to 1Fixed
The report gives no description here.
HighIf there's enough balance in feeToken prior to the swaps, fee will actually be charged from the ETHFixed
The report gives no description here.
HighMultihop trade allows bypassing fees by setting different output tokens for the same input tokenFixed
The report gives no description here.
HighmustUseContractFunds restrictions can be skippedFixed
The report gives no description here.
HighUser can avoid paying fees by sending the ETH separately from the swap transactionFixed
The report gives no description here.
MediumBridging without any swap ops is fee free in MaradonaFixed
The report gives no description here.
MediumCaller does not receive excess gas fee in StargateManageFixed
The report gives no description here.
MediumCCTPManager does not support bridging to Ethereum mainnetFixed
The report gives no description here.
MediumgetBridgeFee() may can't work properlyFixed
The report gives no description here.
Show 7 more
MediumIncompatibility with revert-on-zero-transfer tokensFixed
The report gives no description here.
MediumIt is impossible to bridge USDC via CCTPManager after swapping if the fee token is USDC due to over-restrictive validationFixed
The report gives no description here.
MediumMessi paymaster should approve to zero firstFixed
The report gives no description here.
MediumminAmountOut check must be done after charging the feesFixed
The report gives no description here.
MediumPaymaster will always revert when trying to bridge ETH due to incorrect bridge valueToSend calculationFixed
The report gives no description here.
MediumtryToChargeForGas() return gasAmountCharged may be incorrectFixed
The report gives no description here.
MediumUsers are heavily overcharged for gas fees if they're bridging ETHFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Terrace’s security record
Security firm
Sherlock46 projects reviewed · 67 reports · latest Sep 2026
See Sherlock’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us